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1.0 Notification and Authorization 

Mr. Michael Suffredini, International Space Station (ISS) Program Manager, requested an 
independent review of the separate micrometeoroid and orbital debris (MMOD) catastrophic risk 
assessments for the Mini-Research Module-2 (MRM-2) performed by both the Russian Federal 
Space Agency and NASA. The risk assessments produced by the two organizations differed by 
roughly one order of magnitude. 

This NESC assessment was approved as an out-of-board activity on November 2, 2009 by the 
NESC Director. Mr. Michael Squire, Back-up Principal Engineer at the NASA Langley 
Research Center (LaRC), was selected to lead this assessment. The stakeholder requested a short 
duration for this activity, so the requirement for an assessment plan was waived. The results of 
the assessment were presented to the stakeholders on December 17, 2009. The final report was 
presented and approved by the NESC Review Board on February 3, 201 1. 

The stakeholders for this assessment were Mr. Michael Suffredini and the ISS Program. 
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4.0 Executive Summary 

The Mini-Research Module-2 (MRM-2), a Russian module on the International Space Station 
(ISS), does not meet its requirements for micrometeoroid and orbital debris (MMOD) probability 
of no penetration (PNP). To document this condition, the primary Russian Federal Space 
Agency ISS contractor, S.P. Korolev Rocket and Space Corporation-Energia (RSC-E), submitted 
an ISS non-compliance report (NCR), NCR-RS-MRM2-01 (Appendix E), which was presented 
at the 5R Stage Operations Readiness Review (SORR) in October 2009. In the NCR, RSC-E 
argued for waiving the PNP requirement based on several factors, one of which was the risk of 
catastrophic failure was acceptably low at 1 in 1 1,100 (0.009 percent). However, NASA 
independently performed an assessment of the catastrophic risk resulting in a value of 1 in 1380 
(0.07 percent) and believed that the risk at that level was unacceptable. The NASA Engineering 
and Safety Center (NESC) was requested to evaluate the two competing catastrophic risk values 
and determine which was more accurate. 

Because the outcome of this activity was requested to be complete within approximately 6 
weeks, the analysis of the risk assessments of each organization was necessarily performed at a 
high level. The sources of divergence between RSC-E and NASA catastrophic risk assessments 
were identified as were further areas of analysis that would likely result in a convergence of risk 
assessment values. During the course of the activity, RSC-E and NASA refined their 
assessments and produced risk values that were within a factor of 2 of each other instead of the 
factor of 10 that was initially observed, so determining which assessment was more accurate 
became less urgent. 

The MMOD catastrophic risk is calculated using the risk factor (R or R-factor), which is defined 
as the ratio of catastrophic 1 MMOD impacts to total MMOD impacts. The probability of no 
catastrophic failure (PNCF) is defined as PNCF = PNP R . The catastrophic risk as a percentage is 
defined as 1-PNCF. To explore the influence PNP and R have on catastrophic risk, the NESC 
team performed a rudimentary sensitivity study varying PNP and R in PNCF calculations. The 
results show that while both PNP and R affects the PNCF, the effect of PNP is more pronounced. 
One source of disparity in PNP values (and catastrophic risk) was the MRM-2 finite element 
models (FEM) used by the MMOD risk assessment application Bumper II (Bumper). The FEM 
used by RSC-E was an older version and contained differences from the FEM used by NASA. 

Differing values for R was another contributor to the disparate risk assessments. The RSC-E and 
NASA R-factors used in initial risk assessments were 0.010 and 0.090, respectively. Each R- 
factor is the summation of individual R-factors for each identified risk, and when the individual 
R-factors were compared, differences between NASA and RSC-E became evident. For example, 
RSC-E considered the loss of crew due to hypoxia and a docking unit failure to be higher risks 


1 A catastrophic failure is one that causes the loss of a crew member or loss of the spacecraft. 
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than NASA (i.e., the RSC-E R-factors for each of those risks are greater than NASA’s). 

Similarly, NASA considered the risks due to fragmentation and internal equipment penetration to 
be higher than RSC-E, and those corresponding R-factors were greater for NASA than RSC-E. 

For NASA, R-factors are calculated using the Manned Spacecraft and Crew Survivability 
( MSCSurv ) program. In MSCSurv, the effects of impact velocity are incorporated into the hole 
diameter and crack length predictions using a momentum scaling factor for hole diameter and an 
energy scaling factor for crack length. In contrast, no velocity effects are evident in the hole 
diameter and crack length equations used by RSC-E, so the equations are valid only for a single 
impact velocity (6.5 km/s) from which the equations were empirically derived. In addition, there 
is some ambiguity as to the origin of the values for two of the coefficients used in the RSC-E 
crack length equation, where the values given in one reference do not match those provided in 
another. This may be another source of divergence between risk assessments. 

Although the PNCF values converged during the course of this assessment, both the NASA and 
RSC-E PNCFs indicate that additional shielding should be installed on the MRM-2 to bring the 
PNP into compliance and reduce the catastrophic risk. In addition, because the PNCFs are still 
different by a factor of 2, the NESC team recommends that the two agencies continue to 
collaborate and decrease the discrepancy. As a part of this, the uncertainties associated with the 
R-factors and PNCFs should be defined. Finally, NASA’s plans to reevaluate MSCSurv will 
provide R-factors that are a more accurate reflection of the current ISS configuration and 
operation. 
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5.0 Assessment Plan 

The NESC team relied on documentation review (see References and the Appendices for specific 
documents) and interviews with NASA and Russian MMOD organizations to arrive at findings, 
observations and NESC recommendations. Information from NASA was provided by the NASA 
Astromaterials Research and Exploration Systems/Human Exploration Science (HES) Office. 
Questions for the primary Russian Federal Space Agency ISS contractor, RSC-E, were relayed 
through the HES to their RSC-E counterparts. 


6.0 Problem Description and Background 

6.1 MMOD Risk Assessment Methodology and Requirements 

The PNP is used to assess the ability of a spacecraft to resist MMOD impacts. PNP for a given 
spacecraft is a function of the shield properties, the MMOD environment (flux, directionality, 
mass, size), configuration (e.g., the deployed position of radiators and solar panels may shadow 
areas of the spacecraft), flight attitude, and failure criteria. Bumper II (. Bumper ) is the tool used 
by NASA for calculating PNP. While the PNP gives the probability that an MMOD particle will 
inflict damage exceeding defined failure criteria, it does not describe the potential for the loss of 
life or the loss of the vehicle. The PNCF gives the probability that an MMOD penetration will 
not cause the loss of a crew member or the loss of the vehicle. 

The ratio of catastrophic impacts to total impacts is the risk factor (R-factor or R). The PNCF, 
PNP, and R are related as shown in the equation: 

PNCF = (PNP) r Eq. 6.1-1 

Like PNP, PNCF is expressed as a decimal numeral with a value less than 1. The catastrophic 
risk is typically expressed as a percentage and is defined as: 

Catastrophic Risk = 1 - PNCF Eq. 6.1-2 

The R-factor for a spacecraft (or module) is achieved by summing the individual R-factors for 
each failure mode. This summative R-factor is then used to determine the PNCF and 
catastrophic risk for the overall spacecraft or module. 

The MMOD environment models used for the PNP calculation will affect the resultant PNP. 

The Russian ISS requirements, specified in the Space Station Natural Environment Definition for 
Design (SSP-30425) [ref. 1], state that the orbital debris model used for calculation of PNP is the 
NASA 1991 Orbital Debris Model. A newer model, ORDEM2000, is available and can also be 
used for PNP calculations, but is not used to meet requirements. The micrometeoroid model 
specified by Reference 1 used for MMOD risk analysis is the 1991 Meteoroid Model. The 
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newest meteoroid model is called the Meteoroid Engineering Model (MEM) but also is not used 
to meet requirements. 

The NASA-desired PNP requirement for the MRM-2 is PNP > 0.995 based on an exposure 
duration of 15 years. This is the value specified in the Russian Segment Specification [ref. 2] for 
the Docking Compartment #2 (DC-2), which is structurally identical to the MRM-2. A 
notification of document change (NDC) has been submitted (NDC-41 163-52 Revision B) to 
change “DC-2” to “MRM-2.” However, RSC-E rejected this change and countered with a 
proposal that the MRM-2 PNP requirement should reflect as-launched MMOD capability (i.e., a 
PNP requirement of 0.9734 for 15 years). The MMOD requirement for MRM-2 has not been 
resolved, but for this assessment, the requirement of PNP > 0.995 was assumed. 

6.2 MRM-2 Risk Assessment 

The MRM-2 (Figure 6.2-1) was launched aboard a modified Progress spacecraft in November 
2010. It provides a docking port for Progress and Soyuz spacecraft, adds additional space for 
experiments, and contains data-transmission interfaces for external payloads. It is attached to the 
Russian ISS Segment at the zenith port of the Service Module Transfer Compartment, and 
extends in the zenith direction 4 m (see Figures 6.2-2 and 6.2-3). The maximum hull diameter is 
2.5 m. Two EVA hatches oriented 180 degrees apart are on the forward and rear faces of the 
module. Also located on the MRM-2 exterior is a Strela extendable cargo boom, an equipment 
box, a multipurpose work station, and EVA handrails. The orientation of the module exposes the 
forward face, including most of the forward hatch, to the highest MMOD risk. 

Separate risk assessments performed by RSC-E and NASA concluded that the MRM-2 MMOD 
PNP was less than the requirement of PNP > 0.995. Using the 1991 meteoroid and orbital debris 
environments, RSC-E assessed the PNP as 0.985. Similarly, NASA independently assessed the 
PNP as 0.983 using the same environment models. The violation was documented in the 
noncompliance report (NCR), NCR-RS-MRM2-01 [Appendix E], Within the NCR and the 
discussions it generated, there was agreement between RSC-E and NASA that the MRM-2 PNP 
was not in compliance with a PNP > 0.995 requirement. In the NCR, RSC-E proposed waiving 
the requirement based on several factors, one being that the catastrophic risk for the MRM-2 was 
at an acceptable value of 0.009 percent (1 in 1 1,100/PNCF = 0.9999). NASA calculated the 
catastrophic risk as 0.0725 percent (1 in 1380/PNCF = 0.9993) and judged this to be 
unacceptable (there is no requirement for catastrophic risk or PNCF at the module level). NASA 
further recommended a risk mitigation strategy that included augmenting the MRM-2 MMOD 
shielding. This catastrophic risk disparity is what the NESC team was requested to evaluate. 
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Figure 6.2-1. MRM-2 
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Figure 6.2-2. Location of MRM-2 on the ISS Russian Orbital Segment 
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ISS021E030653 


Figure 6.2-3. MRM-2 on Orbit 

7.0 Data and Evaluation 

7.1 Risk Estimates 

The purpose of this NESC assessment was to quickly provide the ISS Program with an opinion 
regarding the Russian and NASA risk assessments performed for the MRM-2. Time constraints 
limited the NESC team to a high-level review of the methods used by RSC-E and NASA and to 
understand how both parties arrived at their results. Further study would result in an increased 
understanding of the results. 

The PNP and catastrophic risk values originally presented to the NESC team were those from the 
October 26, 2009 5R SORR (see Appendix A) and are shown in Table 7.1-1. 


Table 7.1-1. Risk Comparison from October20Q9 


Agency 

PNP 

R-factor 

Catastro 
phic Risk 

Odds 

Models 

RSC-E 

0.991 

0.010 

9.0xl0 5 

1 in 
11,111 

ORDEM2000/1991 meteoroid 

NASA 

0.992 

0.090 

7.2xl0 4 

1 in 
1385 

ORDEM2000/MEM 
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As the understanding of the MRM-2 MMOD risk matured, the PNP and PNCF evolved from the 
values in contention at the beginning of the assessment. By December 4, 2009, reassessments 
showed that the difference between the RSC-E and NASA catastrophic risk had decreased from a 
roughly tenfold difference to a difference closer to a factor of two (see Table 7.1-2). 


Table 7. t-2. RiskComparisonfromDecem 


Agency 

PNP 

R-factor 

Catastrophic 

Risk 

Odds 

Models 

RSC-E 

0.9955 

0.0512 

2.3xl0 4 

1 in 
4347 

2000 debris/ 1991 meteoroid 

NASA 

0.994 

0.077 

4.8xl0 4 

1 in 
2083 

2000 debris/ 1991 meteoroid 


One reason RSC-E’s PNP increased from 0.991 to 0.9955 is because earlier RSC-E PNP 
calculations used estimated stand-off distances between the outer shield (bumper) and the 
pressure wall that were smaller than the actual configuration. Also, the older PNP runs used 
1998 as the starting year for the debris and meteoroid models, instead of the actual year of 
MRM-2’s launch (2009). Similarly, an increased understanding of the MRM-2 configuration 
increased the NASA PNP from 0.992 to 0.994. 

7.2 Impact of Divergent PNP and R-Factors on Assessed Risk 

A simple sensitivity study was performed to assess the relative impact PNP and R- factor values 
had on the assessed risk. Table 7.2-1 presents the most recent values of PNP, R-factor, assessed 
risk, and risk odds for the MRM-2 module, and includes the RSC-E-to-NASA risk ratio. As seen 
in this table, the assessed risk value calculated by the RSC-E is ~50 percent of the value 
calculated by NASA. 


Table 7.2-1. Risk Values Uses as Baseline for Sensitivity Study 


Agency 

PNP 

R-Factor 

Risk 

Odds 

RSC-E to 
NASA Risk 
Ratio 

RSC-E 

0.9955 

0.0512 

2.31E-04 

1 in 4331 

0.50 

NASA 

0.994 

0.077 

4.63E-04 

1 in 2159 

— 


This sensitivity study considered two scenarios. In Case I, the R-factor was held constant at the 
value equal to the average of the most recent RSC-E and NASA R-factors, while the PNP was 
varied between the most recent RSC-E and NASA values. In Case II, the PNP was held constant 
at the value equal to the average of the most recent RSC-E and NASA PNPs, while the R-factor 
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was varied between the most recent RSC-E and NASA values. Tables 7.2-2 and 7.2-3 present 
the results of this study. It is important to note that since PNP and R-factor are interrelated, 
treating them as independent variables will allow only qualitative conclusions regarding their 
relative effect on assessed risk values. 


Table 7.2-2. Case I: Effect of PNP Values on Risk Assuming a ConstantR-factor 


Agency 

PNP 

Average 

R-Factor 

Risk 

Odds 

RSC-E to 
NASA Risk 
Ratio 

RSC-E 

0.9955 

0.0641 

2.89E-04 

1 in 3460 

0.75 

NASA 

0.994 

0.0641 

3.86E-04 

1 in 2593 

— 


Table 7.2-3. CaseJJjElTectofR-lactor Values on Risk Assuming a ConstantPNP 


Agency 

Average 

PNP 

R-Factor 

Risk 

Odds 

RSC-E to 
NASA Risk 
Ratio 

RSC-E 

0.99475 

.0512 

2.69E-04 

1 in 3711 

0.66 

NASA 

0.99475 

0.077 

4.04E-04 

1 in 2468 

— 


As illustrated in Tables 7.2-2 and 7.2-3, increasing the PNP from the NASA value of 0.994 to the 
RSC-E value of 0.9955, while assuming a constant average R-factor would result in an assessed 
risk by RSC-E that is 75 percent of what would be NASA’s assessed risk. Also, decreasing the 
R-factor from the NASA value of 0.077 to the RSC-E value of 0.0512, while assuming a 
constant average PNP would result in an assessed risk by RSC-E that is 66 percent of what 
would be NASA’s assessed risk. This shows that the assessed risk is more sensitive to PNP 
changes than changes to R. 

7.3 Causes of PNCF Disparity: Finite Element Model (FEM) 

Both NASA and RSC-E use Bumper to perform MMOD risk assessments and to calculate the 
PNP. An FEM that describes the spacecraft geometry is created in Integrated Design and 
Engineering Analysis Software (IDEAS) and used by Bumper. The FEM is separated into 
different elements, each identified with a property identifier (PID). During the course of this 
activity, it was verified that the FEM used by NASA for their ISS Bumper risk assessment was 
different than the one used by RSC-E. The FEM was provided by RSC-E, but RSC-E was using 
an older version for their risk assessments. Figures 7.3-1 and 7.3-2 graphically illustrate the 
differences between the two FEMs in question. 
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Figure 7.3-1. FEM used by RSC-E in Bumper Assessment Showing PID Assignments 



Figure 7.3-2. FEM used by NASA in Bumper Assessment Showing PID Assignments 


7.4 Causes of PNCF Disparity: R-factor 

Another reason for differences in PNCF is disparity in R-factors chosen by RSC-E and NASA. 
The R-factor used by RSC-E in the PNCF estimate presented in the October 2009 NCR was 
0.010, resulting in a catastrophic risk of 9.0xl0' 5 . However, NASA used an R-factor of 0.090 to 
arrive at a catastrophic risk of 7.2xl0~ 4 (see Table 7.1-1). Like the PNPs, R-factors also changed 
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from October to December 2009. RSC-E’s reassessment of catastrophic risk changed the R- 
factor from 0.010 to 0.0512, causing an increase in catastrophic risk. The NASA catastrophic 
risk actually decreased because the R-factor of 0.090 used in the October assessment was 
changed to 0.077 in the December assessment. 

Table 7.4-1 illustrates the individual risk factors and the assumptions that led to the respective R- 
factors for NASA and RSC-E. In general, the differences can be summarized as: 

• NASA does not include docking unit failure as a risk, 

• RSC-E considers the loss of crew due to hypoxia to be a higher risk factor than NASA, 

• NASA considers the risk due to fragmentation to be higher than RSC-E, and 

• RSC-E does not consider the risk due to the catastrophic destruction of internal 
pressurized tanks. 


Table 7.4-!. R-factor Comparison (N/C = Not Calculated in Analysis Provided) 


NASA 

R 

RSC-E 

R 

Risk Description 

Comments 

0 

N/C 

Critical crack (unzipping) 
causes loss of ISS 


0 

N/C 

External equipment 
penetration causes loss of ISS 


0.063 

N/C 

Internal systemic equipment 
penetration causes loss of ISS 

NASA assumption is the presence of internal 
pressurized tanks. 

0 

0.02435 

Docking unit failure 


0.004 

0.02519 

Hypoxia causes loss of crew 

Depends on hole size and time it takes crew to 
egress ISS. RSC-E assumes time of 9.5 
minutes, while NASA uses a distribution 
relating to crew position and amount of time 
spent in different areas of the station. 

0.010 

0.00168 

Fragmentation causes loss of 
crew 

NASA probably assumed a higher occupancy 
that RSC-E. 

0 

N/C 

Thrust induced angular 
velocity causes loss of crew 



To further examine the differences between the Russian and NASA risk assessments requires a 
closer examination of the Russian and NASA probability risk assessment (PRA) processes. The 
ISS MMOD PRA process is described in Appendix C, with details pertaining to RSC-E in 
Reference 3 and NASA in References 4 and 5. Due to the short timeline and high-level review, 
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many questions remained unanswered that, if addressed, would result in an increased 
understanding of the respective PRA processes and their differences. 

NASA PRA Process - Hole Diameter and Crack Length Calculations 

The NASA PRA process is based on the application Manned Spacecraft and Crew Survivability 
( MSCSurv ), which provides as an output the R-factor. In the version of MSCSurv [ref. 5] used 
for these assessments, hole diameter and crack length resulting from an MMOD impact are 
calculated using empirical equations that were developed for 14 common ISS wall configurations 
[ref. 6], These equations are based on impact test data obtained at an impact velocity of ~6.5 
km/s. The effects of impact velocity are incorporated into the hole diameter and crack length 
predictions by NASA using a momentum scaling factor for hole diameter and an energy scaling 
factor for crack length [ref. 7]. 

RSC-E PRA Process - Hole Diameter and Crack Length Calculations 

With respect to the RSC-E PRA process, the equations for module wall hole diameter and 
maximum tip-to-tip crack length (Equations 7.4-1 and 7.4-2) presented in Section 2.2.2 of 
Reference 3 appear to be based on the empirical equations provided in Reference 6 that were 
developed in 1995 using data collected from high speed impact tests performed at impact 
velocities near 6.5 km/s. 


D h = Acos B 9 


cfaf-i) 


1 — e d BL 


Eq. 7.4-1 


where: 


In 


Acos b 6 




i) 


Eq. 7.4-2 


D h = effective hole diameter (cm) 

L h = maximum crack length (cm) 

d p = diameter of a spherical particle (cm) 

6 = incidence angle 

d BL = ballistic diameter limit for an impact velocity of 6.5 km/s and angle of incidence 0 
A, B and C = factors that vary with hole diameter and crack length. For hole diameters 
in a typical Russian module shield: A = 4.323 cm, B = 0.416 cm, and C = 1.474 cm. For 
a pressurized hull crack length, A = 4.89 cm, B = 0.633 cm, and C = 1.44 cm. 

No velocity effects are evident in the RSC-E hole diameter and crack length equations. 

Therefore, these equations are strictly valid at a single impact velocity of 6.5 km/s. RSC-E is 
apparently aware of this restriction and their PRA process and catastrophic risk calculations 
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ignore velocity effects (see Appendix B). As such, the RSC-E risk and PNCF values are 
obtained without considering impact velocity effects. 

RSC-E presented a method for incorporating impact velocity effects for very large projectiles 
(d p /h b > 20) in Reference 3, pages 4-5 (shown in equations 7.4-3 and 7.4-4), but not for smaller 
projectiles. 


D h = 0.45 • d p {[(/i/d p ) 2/3 • v] + 2.o} 

where: 

D h = effective hole diameter (cm) 

d p = diameter of a spherical particle (cm) 

h = barrier thickness (aluminum equivalent) 

V = impact velocity (km/s) 

m P V po = m-pVp + -ftDhhbPbVp -* V p = V p 0 —j^j^t 

1+ V 4m p ) 

where: 


Eq. 7.4-3 


Eq. 7.4-4 


m p = particle mass (units not given) 

V p0 = particle velocity before impact (km/s) 

V p0 = particle velocity after impact (km/s) 

D h = effective hole diameter (cm) 

h b = shield thickness (cm) 

p b = shield material density (units not given) 

Equations 7.4-3 and 7.4-4 for the larger projectiles are based on the conservation of momentum. 
The RSC-E PRA predictions might change if an energy balance were used (i.e., energy losses 
due to shock heating, etc. would be subtracted out). It would also be instructive to compare the 
predictions of the momentum-based approach (or a combined energy-and-momentum-based 
approach) against actual data, and against the predictions of empirical hole size and crack length 
equations for the particle size regime considered. 

Empirical Equation Coefficient Issues 

Inspection of the values of the coefficients A, B, and C in Equation 7.4-1 (from Reference 3) for 
hole diameter reveals that all three values match the values of A, B, and C in Reference 6 for the 
Research Module hole diameter equation. However, the values of B and C for crack length as 
given in Reference 3 (Equation 7.4-2) do not match the values of B and C in Reference 6 for the 
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Research Module crack length equation (Table 7.4-2, in blue). The value of A for the crack 
length equation in Reference 3 does match the value of A in Reference 6, indicating that the 
asymptotic value of crack length according to Reference 3 will eventually match that of 
Reference 6. 


L h = Acos b 0 




1 — e d BL 


Eq. 7.4-2 


Table 7.4-2. Coefficients for Equation 7.4-2 


Coefficient 

Value for Hole 
Diameter from 
Ref. 3 (cm) 

Value for Hole 
Diameter from 
Ref. 6 (cm) 

Value for Crack 
Length from Ref. 
3 (cm) 

Value for Crack 
Length from Ref. 
6 (cm) 

A 

4.323 

4.323 

4.89 

4.89 

B 

0.416 

0.416 

0.633 

0.498 

C 

1.474 

1.474 

1.44 

9.518 


When RSC-E was queried regarding the source of the values of B and C for the crack length 
equation in Reference 3, their reply was that they are based on the “experimental results obtained 
in MSFC [where] the crack length = 1 .5 x penetration hole.” From the form of equation 7.4-2, it 
is evident that coefficient B factors in the effects of impact obliquity, while coefficient C governs 
the rate at which the equation’s asymptotic value is reached. However, the values of B and C 
given for the crack length equation do not appear to cause the crack length values calculated 
using that equation to be 1.5 times the pressure wall hole diameter. If that were the desired end 
result, then it would appear that the value of coefficient A for the crack length equation would 
need to be 1 .5 times the value of the coefficient A for the hole diameter equation. However, 
those two values as given in Reference 3 are within approximately 10 percent of each other 
(Table 7.4-2, in pink). Hence, the explanation provided by RSC-E regarding how the values of B 
and C for the crack length equation are obtained is not clear and should be revisited to more fully 
understand the role of these coefficients in affecting the outcomes of the RSC-E PRA process. A 
review of the Research Module pressure wall hole diameter and maximum tip-to-tip crack length 
data obtained at impact test velocities near 6.5 km/s reveals that crack lengths are, on average, 
approximately 1.33 times larger than corresponding hole diameters [ref. 8] over all of the impact 
obliquities and projectile diameters tested. Therefore, the RSC-E contention that the crack length 
= 1.5 x penetration hole diameter appears to be reasonable and should yield more conservative 
(i.e. higher) values of assessed risk if implemented in a PRA process. 

Figure 7.4-1 compares predictions of pressure wall tip-to-tip crack length for normal 6.5 km/s 
impacts on a Research Module wall target as given by Equation 7.4-2 using the values of the 
coefficients B and C given in Reference 3 (the RSC-E equation), and in Reference 6 (the NASA- 
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equivalent equation). Empirical crack length data for this type of impact on this wall system are 
also shown. As can be seen in Figure 7.4-1, crack-length predictions can vary significantly 
depending on the values of the coefficients B and C. Specifically, using the values of B and C 
identified by RSC-E results in predictions of crack length that are smaller than if the coefficients 
generated by the NASA-equivalent equation were used. 



Figure 7.4-1. Comparison of RSC-E Empirical Predictions of Tip-to-Tip Crack Length for the 
Russian Research Module, Normal Impact at 6.5 km/s 
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8.0 Findings, Observations, and NESC Recommendations 

8.1 Findings 

The following findings were identified: 

F-l. Based on the risk assessment for either source, augmented MMOD shielding for MRM-2 
is warranted for MRM-2. 

F-2. According to the most recently produced values, the discrepancy between NASA and 

RSC-E risk is approximately a factor of 2, instead of the factor of 10 displayed at the 5R 
SORR. 

F-3. The planned NASA and RSC-E tasks are appropriate to close the gap between the 
MMOD risk assessments. 

F-4. Variations in PNCF between NASA and RSC-E may be caused by: 

• RSC-E using older FEM than NASA, 

• PNP calculations using different property identification mapping, and 

• Differing assumptions resulting in different R-factors. 

F-5. The components of the individual R-factors are different, and this may cause a larger 

variation in PNCF than either NASA or RSC-E are currently accounting for. Variations 
in R-factor between NASA and RSC-E may be caused by: 

• RSC-E assuming no risk due to pressurized tanks within the module while NASA 
does, 

• NASA not accounting for docking mechanism failure, 

• RSC-E assuming higher risk of hypoxia, 

• RSC-E assuming lower risk from fragmentation (function of time spent in module), 
and 

• Differences between how NASA and RSC-E calculate rear wall hole diameter and 
crack length, including an apparent lack of velocity effects in the RSC-E approach 
across the entire impact velocity spectrum (i.e., 1-16 km/s) and the use of empirical 
equation coefficients of unknown origin. 

F-6. With the information available, the two PNCFs cannot be adequately evaluated. 
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F-7. Different uncertainty assumptions may contribute to different risk assessments. 

F-8. There is no NASA mechanism for incorporating changes in the R-factor due to model 
changes, shield changes, and operational changes. 

8.2 Observations 

0-1. It is unclear how NASA and RSC-E take into account the differences in construction 
between the actual MRM-2 and the Research Module wall system as tested in 1995 in 
their hole diameter and crack length equations. 

0-2. Some of the empirical coefficients used by RSC-E in its empirical crack length equation 
do not match corresponding coefficients in the original reference for the equation, and the 
explanation provided by RSC-E does not appear to fully explain the differences. 

0-3. Using the RSC-E equation for crack length could lead to values of assessed risk that are 
lower as compared to those that might be obtained using the NASA-equivalent equation, 
assuming no other variations between the RSC-E and NASA PRA processes. 

0-4. Considering the magnitudes of the changes in PNP and R-factor values and the resulting 
corresponding changes in assessed risk values, it is evident that assessed risk value is 
more sensitive to changes in PNP value than it is to changes in R-factor value. 

8.3 NESC Recommendations 

The following NESC recommendations were identified and directed towards the ISS Program 

unless otherwise identified: 

R-l. Install additional MMOD shielding on the MRM-2 to reduce the PNP to the level 
specified in the requirements. (F-l and F-3) 

R-2. Continue NASA and RSC-E collaboration to narrow the gap between R-factors and 
PNCF for MRM-2. (F-2, F-3, F-5, F-6, and F-7) 

R-3. Define uncertainties in PNCFs and the terms factored into their calculation. 

(F-5, F-6, and F-7) 

R-4. Proceed with current NASA plans to update R-factors in risk assessments. ( F-7 and F-8) 
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9.0 Alternate Viewpoints 

There were no alternate viewpoints identified during the course of this assessment by the NESC 

team or the NRB quorum. 

10.0 Other Deliverables 

No unique hardware, software, or data packages, outside those contained in this report, were 

disseminated to other parties outside this assessment. 

11.0 Lessons Learned 

No applicable lessons learned were identified for entry into the NASA Lessons Learned 

Information System (LLIS). 

12.0 Definition of Terms 

Corrective Actions Changes to design processes, work instructions, workmanship practices, 
training, inspections, tests, procedures, specifications, drawings, tools, 
equipment, facilities, resources, or material that result in preventing, 
minimizing, or limiting the potential for recurrence of a problem. 

Finding A conclusion based on facts established by the investigating authority. 

Lessons Learned Knowledge or understanding gained by experience. The experience may 
be positive, as in a successful test or mission, or negative, as in a mishap 
or failure. A lesson must be significant in that it has real or assumed 
impact on operations; valid in that it is factually and technically correct; 
and applicable in that it identifies a specific design, process, or decision 
that reduces or limits the potential for failures and mishaps, or reinforces a 
positive result. 


Observation A factor, event, or circumstance identified during the assessment that did 

not contribute to the problem, but if left uncorrected has the potential to 
cause a mishap, injury, or increase the severity should a mishap occur. 
Alternatively, an observation could be a positive acknowledgement of a 
Center/Program/Project/Organization’s operational structure, tools, and/or 
support provided. 


Problem The subject of the independent technical assessment. 

Proximate Cause The event(s) that occurred, including any condition(s) that existed 

immediately before the undesired outcome, directly resulted in its 
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occurrence and, if eliminated or modified, would have prevented the 
undesired outcome. 

Recommendation An action identified by the NESC to correct a root cause or deficiency 

identified during the investigation. The recommendations may be used by 
the responsible Center/Program/Project/Organization in the preparation of 
a corrective action plan. 


Root Cause One of multiple factors (events, conditions, or organizational factors) that 

contributed to or created the proximate cause and subsequent undesired 
outcome and, if eliminated or modified, would have prevented the 
undesired outcome. Typically, multiple root causes contribute to an 
undesired outcome. 


13.0 Acronyms List 

DC-2 

Docking Compartment #2 

FEM 

Finite Element Model 

IDEAS 

Integrated Design and Engineering Analysis Software 

ISS 

International Space Station 

LaRC 

Langley Research Center 

MEM 

Meteoroid Engineering Model 

MEO 

Meteoroid Environment Office 

MMOD 

Micrometeoroid and Orbital Debris 

MOD 

Mission Operations Directorate 

MRM-2 

Mini-Research Module 2 

MSFC 

Marshall Space Flight Center 

MTSO 

Management and Technical Support Office 

NCR 

Noncompliance Report 

NDC 

Notification of Document Change 

NESC 

NASA Engineering and Safety Center 

NRB 

NESC Review Board 

PID 

Property Identifier 

PNCF 

Probability of No Catastrophic Failure 

PNP 

Probability of no Penetration 

PRA 

Probabilistic Risk Assessment 

R 

Risk Factor 

RSC-E 

S.P. Korolev Rocket and Space Corporation - Energia 

SORR 

Stage Operations Readiness Review 
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Appendix A. 5R Stage Operations Readiness Review 

The documents presented in Appendix A, while pre-decisional 
when created, are now considered to be post-decisional 
due to events that have transpired since the date of the presentation. 


National Aeronautics and 
Space Administration 



MRM-2 MMOD NCR 


Presented to the 5R Stage Operations Readiness Review (SORR) 

KX/Dana M. Lear 
KX/Eric L. Christiansen 
ES/Komel Nagy 
NA/George K. Gafka 

26 October 2009 


Pre-decisional - Internal Use Only 

National Aeronautics and 

Space Administration Purpose of Presentation 



• To present RSC-Energia’s micro-meteoroid orbital debris (MMOD) 
non-compliance report (NCR) for Mini-Research Module 2 (MRM-2) to 
the 5R SORR 

• MRM-2 NCR is for 6 months starting at flight 5R (Nov 2009) 

• RSC-Energia does not plan to add additional MMOD protection to MRM-2 

• Discuss dissenting opinion: 

• Unacceptable to leave MRM-2 configuration as-is for the life of ISS 

• Risk mitigation strategy must be developed over the next 6 months. The 
risk mitigation strategy will likely involve on-orbit augmentation. 


Pre-decisional - Internal Use Only 


1-2 
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National Aeronautics and 
Space Administration 


MRM-2 MMOD Risk 



• MRM-2 MMOD protection is non-compliant 

• MRM-2 module has same structure as Docking Compartment 1 (DC-1) 

• DC-1 was also non-compliant 

• MRM-2 assessed PNP is 0.985 for 15years versus 0.995 requirement 

• In the NCR, RSC-Energia compares MRM-2 PNP to 0.996 DC-1 
requirement, because MRM-2 PNP requirement (0.995) was not agreed to 
by RSC-Energia 

• MMOD requirements based on 1991 debris model 

• MMOD risk terminology for MRM-2 

• " Penetration " risk is defined as complete penetration of pressure shell (crew 
cabin leak) or complete penetration of the glass windows that endangers 
crew/ISS survivability 

• “ Catastrophic ” risk is defined as a penetration that results in loss of crew and 
includes three failure modes: 

1 . Death of crew from hypoxia due to rapid depressurization (9.5 minutes is 
required for crew to egress Soyuz without deactivating ISS per SSP 50506) 

2. Rupture of pressure shell due to dynamic crack growth caused by 
penetration 

3. Death or injury of crew as result of high-speed debris caused by penetration 

Pre-decisional - Internal Use Only 1-3 

National Aeronautics and 

space Administration Penetration Risk Assessment Results 



• Penetration Risk Requirement (SSP 41163 Russian Segment Spec): 

• 1991 Debris and 1991 Meteoroid Model (SSP-30425, Rev. B) 

• 15-year exposure Penetration Risk <= 0.5% (PNP>=0.995) Odds 1 in 200 

• RSC-E Penetration Risk Assessment Results: 

• 1991 Debris (SSP-30425. Rev. B) and 1991 Meteoroid model (SSP-30425. Rev. B) 

• Penetration Risk = 1.5% (PNP=0.985) Odds 1 in 66 (does not meet requirement) 

• 2000 Debris (QRDEM2000) and 1991 Meteoroid model (SSP-30425. Rev. B) 

• Penetration Risk = 0.9% (PNP=0.991) Odds 1 in 1 17 (does not meet requirement) 

• NASA and RSC-E PNP results are comparable. 


MRM-2 MMOD Risk Assessment Results (15 year exposure) 

Assessment Assessed vs. 

Source Environments PNP Risk Odds Requirement 


RSC Energia 

2000 debris & 
1991 meteoroid 

0.991 

0.9% 

1 in 117 

172% 

NASA 

0.992 

0.8% 

lin 125 

160% 

RSC-Energia 

1991 debris & 
1991 meteoroid 

0.985 

1.5% 

1 in 66 

304% 

NASA 

0.983 

1.7% 

lin 60 

337% 


Pre-decisional - Internal Use Only 1-4 
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s“Z“ d ISS MMOD Protection Status 

(updated with latest RSC-Energia results) 

(0T 



• The majority of ISS elements meet MMOD protection requirements 

• Most ISS MMOD risk associated with a few elements not meeting protection 
requirements (non-compliant) 

• Service Module (SM) 

• Soyuz and Progress 

• Docking Compartment 1(DC-1) and MRM-2 

MMOD risk for pressure shell leak and critical damage to external pressure vessels & stored energy items (CMGs) 
Over 10-years (2010 - 2020) 


16% 

14% 

12 % 

10% 

8 % 

6% 

4% 

2% 

0 % 



ISS lOvear PNP: 

- Requirement >= 0.76 







- Assessed = 0.51 
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National Aeronautics and 
Space Administration 


Expected improvement in MMOD 


penetration risk given changes in RS hardware 




• Changes in Soyuz, Progress, Service Module, DC and MRM-2 MMOD 
protection 

• RSC-Energia proposal to add bumper and standoffs to Soyuz/Progress orbital module 

• RSC-Energia proposal to add local shielding and/or deployable “wings" to Service Module 

• RSC-Energia proposal to augment MRM-2 


MMOD risk for pressure shell leak and critical damage to external pressure vessels & stored energy items (CMGs) 
Over 10-years (2010 - 2020) 

With improvement in MMOD protection 

H penetration risk (%) with ORDEM2000 ■ with enhanced shielding (%) 


16% 


14% 

12% 

10% 

8% 

6% 

4% 

2% 

0% 



Note SM risk reduction based on adding 
“wings" as originally proposed by RSC-Energia 
to meet MMOD requirements. "Local" shielding 
recently proposed by RSC-Energia would 
provide less protection (4.2% with local 
shields versus 2.5%-3% with wings). 


rr; 
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National Aeronautics and 
Space Administration 


Consequences of MRM-2 Penetration 

15-year catastrophic and evacuation risk assessment 



• Loss-of-crew due to depress, internal effects (fragments), catastrophic rupture 
of pressure shell, secondary failures of pressurized equipment 

• NASA MRM2 as-is assessment: 1 in 1,380 = 0.07% catastrophic risk 

• NASA MRM2 compliant assessment: 1 in 2,450 = 0.04% catastrophic risk 

• RSC-E MRM2 as-is assessment: 1 in 11,100 = 0.009% catastrophic risk 

• This value has changed from 1 in 2,500 to 1 in 222 to 1 in 11,100 in recent months 

• Loss-of-mission: ISS evacuation without loss of crew due to depress of MRM- 
2 and SM 

• NASA calculation: 1 in 151 = 0.66% evacuation risk 

• RSC-E assessment: (not provided) 

• Loss-of-function: depress MRM-2 results in loss of a Soyuz/Progress docking 
port and potential reduction of ISS crew capability from 6 to 3 

• Resource costs: 

• Replace air lost during depress event 

• Crew time required to find and repair penetration through pressure shell 

• Replace internal damaged components 

Pre-decisional - Internal Use Only 1-7 
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Space Administration 


Rationale for Risk Acceptance 
in current MRM-2 NCR 



1 . In the event of MRM-2 penetration, ISS crew action scenarios have been 
developed with the goal of ensuring crew safety and the integrity of the 
station (SSP 50506). 

2. The RSC-E probability of a catastrophic penetration for MRM2 (probability 
of crew death as a result of penetration) over 1 0 years does not exceed 
6* *1 0- 5 (9*1 0 5 over 15 years). The NASA calculated probability of a 
catastrophic penetration for MRM2 over 10 years is 5*10^ (odds of 1 in 
2,070), and for 15 years is 7*10^ (odds of 1 in 1 ,380). RSC-E calculations 
were performed with the following assumptions: 

• ORDEM 2000 was used; 

• Three possible consequences of penetration of the pressurized hull leading to 
catastrophic consequences in less than 9.5 minutes (the time stipulated in SSP 
50506 needed for the crew to egress to the Soyuz without deactivating the 
station) were considered: 

> destruction of the pressurized hull as a result of the dynamic growth of the crack caused by the 
penetration; 

> Injury or death of crewmembers as a result of waves caused by high-velocity debris formed during 
penetration. 

> Death of the crew as a result of hypoxia brought on by rapid depressurization of the ISS. 
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National Aeronautics and 
Space Administration 


Rationale for Risk Acceptance 
in current MRM-2 NCR (continued) 



3. The following functions are retained during MRM-2 depressurization: 

• MRM-2 thermal control; 

• Docking of Progress vehicles and undocking of Soyuz vehicles; 

• Refueling of ISS RS fuel tanks via the MRM2 TMflT (refueling transport lines) 

4. The volume of air lost during MRM-2 depressurization, taking into account 
the time required to isolate the module from the station (16 minutes) is 
estimated to be 30 m 3 . If a re-pressurization is required, these losses may 
be compensated for either by equalizing pressure with the rest of the ISS 
(volume is approximately 500 m 3 ) as is done after nominal EVA, or by 
using the portable repress tanks (EH 11) (there are three located 
permanently on the ISS RS, which are sufficient to pressurize MRM-2). 


National Aeronautics and 
Space Administration 
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Rationale for Risk Acceptance 
in current MRM-2 NCR (continued) 



5. There are the following measures for detecting and isolating a leak (see 
hazard report RSCE-103-MRM2): 

• Upon depressurization of the MRM-2 pressurized compartment, a pressure 
drop emergency signal is generated. This emergency signal is displayed on the 
MRM-2 panel and relayed throughout RS and USOS modules. 

• The drop in pressure is monitored by pressure sensors installed in MRM2. 

• The depressurized compartment in RS modules, including MRM2, is identified 
via the actuation of air flow sensors installed near ISS RS module docking 
assemblies. 

6. The PNP estimate according to ORDEM2000 is 0.991 over 15 years. 

7. The capability exists for the ISS to perform an avoidance maneuver for 
orbital debris tracked by a space monitoring system by changing attitude. 
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National Aeronautics and 
Space Administration 


Dissenting Opinion 



• RSC-Energia recommends keeping MRM-2 shielding as-launched 
for remaining life of program. 

• U.S. MMOD team and the ISS Chief Safety and Mission Assurance 
Officer (SMA Technical Authority) believe: 

• it is unacceptable to leave the MRM-2 configuration as-is for the long- 
term life of ISS 

• future risk mitigation strategy should be developed by RSC-E within 6 
months of MRM-2 launch, to include MMOD shielding augmentation, to 
reduce ISS MMOD risk 
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Space Administration 



Backup Charts 
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National Aeronautics and f , 4 

space Administration MMOD Damage to ISS 

f 


Several recently identified damages appear to 
be due to MMOD strikes with sufficient energy 
to cause significant damage (i.e., pressure 
shell and/or window failure) to lightly protected 
areas of ISS such as Progress & Soyuz Orbital 
Module, Service Module, MRM-2 & DC 

• FGB compressor damage due to 2mm-3mm 
particle 

• P6 radiator damage due to 3mm-5mm particle 

• SM solar array damage due to >2mm particle 

• STS-1 1 8 radiator damage due to 1 5mm particle 

Good agreement between actual damage and 
predicted damage for ISS Pressurized 
Logistics Module and Shuttle (damage 
identified after return to ground and analyzed 
via Scanning Electron Microscope) 



FGB damage (1” x 2") likely due to 
2mm-3mm diameter MMOD particle 



P6 radiator damage noted during STS-1 18 (0.75" diameter) 
likely due to 3-5mm diameter MMOD particle 
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STS-1 28 Shuttle Radiator Impact 
shows why adding protection to vulnerable areas 
of spacecraft is a good thing 



• During STS-1 28, an impact occurred on center-line of a radiator doubler, which 
protects the Shuttle radiator flow tubes from MMOD 

• Impact crater penetrated through the thermal tape, completely through the 0.02" thick doubler, and 
damaged the facesheet below the doubler 

• Analysis indicates this impact would have penetrated the flow tube if the doublers were not present 

• Doublers added in 1997-1999 time period, to provide additional protection for ISS missions 


• Conclusion: Doublers performed as designed, preventing a radiator tube puncture 



MMOD impact into Radiator LH1 doubler 
protecting flow-tubes 
Crater diameter = 0.8 mm 
Crater depth = 0.58 mm 
Doubler thickness = 0.51 mm 



Simulation of impact after 2 
...■■> micro-seconds with doubler 
crater through thermal tape 
. (green) and penetration nearly 
through doubler (red). . . i.e., 
similar to actual damage. 


Simulation of same impact 
after 2 micro-seconds without 
doubler crater through thermal 
tape (green), through 
facesheet (yellow) and through 
flow tube wall (blue).. .i.e., leak 
would have occurred without 
doubler 
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National Aeronautics and 
Space Administration 


What can be said about MRM-2 MMOD risk 
from past history of DC-1 



• DC-1 was launched Sep 2001 : no penetration over 8.1 years ago 

• Best Case: No penetration of DC-1 for next 8.1 years 

• Implies (at best) a penetration every 16.2 years (i.e., 8.1 years + 
another 8. 1 years before a penetration occurs) 

• 1 penetration every 16.2 years = 46% risk of penetration over 15 
years 

• Worst Case: Penetration in the immediate future 

• Implies (at worst) a penetration every 8.1 years = 71% risk of 
penetration over 15 years 

• Both the best and worst case risks are much higher than our current 
MRM-2 risk calculations 

• Surviving ~8 years without a penetration of DC-1 does not mean that 
MMOD risk is small for MRM-2 

• Lack of a penetration event of DC-1 since launch (8.1 years) should 
NOT be used as part of the basis of acceptance of MRM-2 MMOD risk. 
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History of Docking Compartment and 
MRM-2 Catastrophic Risk by RSC-E 


1-15 


• August 4. 2006 (MMOD TIM Protocol): 

• Docking Compartment 10 year catastrophic risk: 

• 2E-03 (0.2%) to 5E-03 (0.5%), odds 1 in 200 to 1 in 500 

• Depends on evacuation time assumptions 


• July 15. 2009 (RSC-E MRM-2 NCR): 

• 10 year catastrophic risk: 4E-04 (0.04%), odds 1 in 2,500 


• September 24. 2009 (RSC-E MRM-2 NCR): 

• 10 year catastrophic risk: 3E-03 (0.3%), odds 1 in 333 

• 1 5 year catastrophic risk: 4.5E-03 (0.45%), odds 1 in 222 

• Is 6% of the total ISS catastrophic risk, but only 2% of ISS surface area 

• NASA commented that this risk seemed too high 

• October 6. 2009 ( current RSC-E estimate from MRM-2 NCR): 

• 10 year catastrophic risk: 6E-05 (0.006%), odds 1 in 16,700 

• 15 year catastrophic risk: 9E-05 (0.009%), odds 1 in 11,100 

• RSC-E updated estimate after receiving feedback from NASA regarding September 24, 2009 catastrophic 
results 

• 50x risk reduction from value provided in previous NCR 

• Based on reduced time (9.5minutes) to evacuate crew without isolating modules 

Pre-decisional - Internal Use Only 1-16 


NESC Request No.:TI-09-00592 


© 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

09-00592 

Version: 

1.0 

Independent Review of US and Russian PRAs for 
MRM2 MMOD Risk 

Page #: 

35 of 91 


National Aeronautics and 
Space Administration 


Hole diameter versus ISS Pressure Drop 



Pressure in 16 minutes for a 50% packing factor Pressure (psi) 



Hole Diameter (inches) 


Per Boeing/Russell Graves. 16 October 2009 
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Lower 

Nominal 

Upper 

15-year Penetration Risk (odds) 

0.59% 

0.80% 

1.06% 

2000 Debris model & Meteoroids 

1 in 171 

1 in 125 

1 in 95 

15-year Penetration Risk (odds) 

1 .23% 

1 .68% 

2.22% 

1991 Debris model & Meteoroids 

1 in 81 

1 in 60 

1 in 45 


• Uncertainty estimates for MRM-2 were scaled from results of study 
conducted for S&MA of Shuttle MMOD uncertainty (Uncertainty factor of 
1.35) 

• Hyde J , Christiansen. E . Bumper-ll Micrometeoroid and Orbital Debris Threat Assessment Code Estimaton of Orbitei Uncertainty 
Bounds v2.0. JSC Report 63999 Rev A. October 2007 

• Lower and upper bound represent the 5% and 95% model output; center 
is the mean 

• Risk assessment uncertainties to the following variable were considered: 

• MM and OD flux 

• OD velocity 

• MM and OD density 

• MMOD ballistic limit equations 

• Did not consider uncertainties associated with damage criteria 
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National Aeronautics and 
Space Administration 


Comparison of ISS MMOD Risk with and 
without MRM-2 Shielding Enhancement 


(with ISS meeting MMOD requirements) 



Assuming ISS meets MMOD requirements (i.e. , 0.76 PNP over lOyears) 
due to changes in Russian Segment MMOD protection 



MRM-2 

ISS 



Case 

PNP 

PNP 

Risk 

Odds 

MRM-2 compliant shielding 

0.997 

0.757 

24.3% 

1 in 4.1 

MRM-2 "as-is" shielding 

0.994 

0.755 

24.5% 

1 in 4.1 

Total ISS risk increase (relative risk):| 

0.8% | 



• Analysis assumptions: 

• 10 year exposure 

• 2000 debris (ORDEM2000) environment 

• 1991 meteoroid (SSP-30425, Rev.B) environment 

• Non-compliant MRM-2 increases ISS MMOD 
penetration risk by 0.8% 
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Comparison of ISS MMOD Risk with and 
without MRM-2 Shielding Enhancement 

(with no changes to RS MMOD protection) 



Assuming no change to Russian Segment MMOD protection (i.e., no 
improvement in SM, Progress, orSoyuz) 


MRM-2 

ISS 



Case PNP 

PNP 

Risk 

Odds 

MRM-2 compliant shielding 0.997 

0.430 

57.0% 

1 in 1.8 

MRM-2 "as-is" shielding 0.994 

0.428 

57.2% 

1 in 1.7 

Total ISS risk increase (relative risk):| 

0.2% 



• Analysis assumptions: 

• 10 year exposure 

• 2000 debris (ORDEM2000) environment 

• 1991 meteoroid (SSP-30425, Rev.B) environment 

• Non-compliant MRM-2 increases ISS MMOD 
penetration risk by 0.2% 
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National Aeronautics and 
Space Administration 


Comparison of MMOD Catastrophic Risk with 
and without MRM -2 Shielding Enhancement 
(with no changes to RS MMOD protection) 



Assuming no change to Russian Segment MMOD protection (i.e., no 
improvement in SM, Progress, or Soyuz) 



MRM-2 

Catastrophic 


Case 

PNCF 

Risk 

Catastrophic Odds 

MRM-2 compliant shielding 

0.99% 

0.04% 

1 in 2,489 

MRM-2 "as-is" shielding 

0.9993 

0.07% 

lin 1,380 


• Analysis assumptions: 

• 1 5 year exposure 

• 2000 debris (ORDEM2000) environment 

• 1991 meteoroid (SSP-30425, Rev.B) environment 
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MRM-2 NCR Assessment 
RSC-E Finite Element Model 




MRM-2 NCR RSC-E MMOD Risk Assessment Finite Element Model 
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National Aeronautics and 
Space Administration 


MRM-2 NCR Assessment 
NASA Finite Element Model 




MRM-2 NCR NASA MMOO Risk Assessment Finite Element Model 
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MRM-2 NCR Assessment 
NASA Finite Element Model 




Looking ISS Starboard 


Looking ISS Forward 


Looking ISS Nadir 
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National Aeronautics and 
Space Administration 


MRM-2 NCR Assessment 
NASA Finite Element Model 
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DC-1 & MRM-2 Shield Performance 
Capability & Finite Element Model 
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BUMPER Code Finite 


06 

05 

04 

03 

02 

0.1 

0 


Typical DC-1 & MRM-2 Shield 
(Whipple shield with MLI thermal blankets) 


Ballistic Limit of shield (typical) 

0 35cm Al projectile @ 7km/s, 0* 


0.1cm Aluminum AMG6 bumper 


0 4cm Aluminum AMG6 pressure shell 


DC-1 & MRM-2 Ballistic Limit Equations and HVI Test Data 



Velocity (km/s) 
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Appendix B. Questions to RSC-E with Replies 

NESC Questions for RSC-E with responses from RSC-E: 

Note: RSC-E responses ore shown here as received (unedited) 

1. Do threaded holes exist on the frames of Service Module windows #1 and #2 (on the Service 
Module Working large diameter cylinder)? If so, could these be used to attach a window cover? 

• RSC-E 01/30/10 reply: 'To be studied with SME in a weeks time (TBS)." 

2. Can you e-mail or bring to the TIM any structure or materials information you have regarding 
the Service Module MMOD wings? 

• RSC-E 01/30/10 reply: "Information to be delivered on TIM." 

3. Are there two hatches on MRM-2? 

• RSC-E 01/30/10 reply: "Yes" 

4. What are the clearance requirements for the MRM-2 antennas, particularly those around the 
zenith cylinder and central sphere? 

• RSC-E 01/30/10 reply: 'TBS" 

5. Is the MRM-2 MU grounded? If so, are all areas grounded or just some areas? 

• RSC-E 01/30/10 reply: 'TBS" 

6. Do you have any information regarding outgassing from the Russian Kevlar? 

• RSC-E 01/30/10 reply: 'TBS" 

7. What is the areal density of the Russian Kevlar and strength? 

• RSC-E 01/30/10 reply: "0.160g/cm 2 , for fiber band 25x200mm - 3500N" 

8. What are the kick load requirements for the MRM-2 exterior thermal blanket? 

• RSC-E 01/30/10 reply: 'TBS" 

9. What is the range of motion of the MRM-2 Strela arm? 

• RSC-E 01/30/10 reply: 'TBS" 

10. What is the range of motion of the MRM-2 hatches? 

• RSC-E 01/30/10 reply: 'TBS" 

11. Where on MRM-2 can't we add shielding due to interferences or keep-out zones? 

• RSC-E 01/30/10 reply: 'TBS" 

12. Does RSC-E have any ideas on how we could add MMOD protection to MRM-2? 

• RSC-E 01/30/10 reply: "to be delivered on TIM and included in the presentation to be 
send for you before TIM." 

13. For the catastrophic risk calculations as outlined in SS40950 ("A Study of the Probability of 
Catastrophic MMOD Penetration of the Docking Compartment Pressurized Hull", Technical 
Report n38332-311), how are the effects of impact velocity factored into the predictions of hole 
diameter and crack length (page 4)? 

• RSC-E 01/30/10 reply: "the velocity factor in catastrophic risk calculations was ignored ( 
fixed at 6.5 km/s) because of lack of experimental data" 

14. How would the predictions of the RSC-E probabilistic risk assessment as outlined in SS40950 for 
very large projectiles change if an energy balance were used as well? 

• RSC-E 01/30/10 reply: "to be discussed on TIM" 

15. Are you using the hole diameter and crack length equations from the "Research Module" wall 
system for MRM-2? If yes, 
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a. how are differences in construction between MRM-2 and the "Research Module" 
accounted for? 

• RSC-E 01/30/10 reply: "Yes ->a) the differences in construction between MRM-2 and RM 
were not accounted for. So the calculation results were conservative in our estimates." 

b. where do the values of B and C for the crack length equation given on page 4 in SS40950 
come from? 

• RSC-E 01/30/10 reply: "b) according to experimental results obtained in MSC the crack 
length=1.5x penetration hole." 

16. NCR-RS-MRM2-01 lists three possible consequences of a penetration of the pressurized hull of 
the MRM-2 module that might lead to a catastrophic end-state (module rupture, crew injury or 
death from impact-induced fragments or shock waves, and hypoxia), and lists three functions 
that would not be affected by such an impact (thermal control, docking / undocking functions, 
and refueling). The most recent PCF values for MRM-2 (19-Oct-09) are: 

1. Module rupture = 0.0 

2. Docking failure = 2.9xl0e-05 

3. Hypoxia = 3.0xl0e-05 

4. Crew injury = 0.2xl0e-05 

a. Why is the PCF of module rupture given as 0.0 if it is listed as a possible consequence 
that could lead to catastrophic end-state? 

• RSC-E 01/30/10 reply: "a) this catastrophic consequence was found to be practically 
zero because MRM_2 critical crack length is estimated to be caused by debris of size 
over 20cm that is beyond particle size range under consideration." 

b. Why is the PCF of docking failure non-zero if it is listed as a function that would not be 
affected by a potentially catastrophic impact? 

• RSC-E 01/30/10 reply: "b) these are two different docking mechanisms involved: 1) in 
NSR - docking function of MRM-2 docking mechanism 2) in catastrophic risk calculations 
- docking mechanism of some joint between two ISS modules which fails as the result of 
torque caused by air flow through MRM-2 penetration hole." 

17. Are there any constraints to adding shielding over the MU from a passive thermal standpoint? 

a. RSC-E 01/30/10 reply: 'TBS" 
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Appendix C. ISS Probabilistic Risk Assessment: MMOD Assessment 
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ARES DRD-A-SA-05 

Probabilistic Risk Assessment (PRA) Report 
Assembly Complete Model Micrometeoroid & Orbital Debris (MMOD) 
PRA Report No.: ISSPRA-MMOD-OOl 


February 4, 2008 


Prepared by: 


Tiffany Wilson 
Warren Grant 
ARES Corporation 
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1 Introduction 

The purpose of this notebook for the International Space Station (ISS) Micro Meteoroid Orbital 
Debris (MMOD) Probabilistic Risk Assessment (PRA) is to document the model assumptions, 
Event Sequence Diagrams (ESDs) and any other directly pertinent information that will allow an 
informed PRA practitioner to review or recreate the ISS MMOD models. This model is to be 
used as part of the integrated model of the Station PRA. As such, it should be pointed out that 
quantification of this model separately may not be meaningful in terms of assessing the 
contribution of MMOD to the overall risk to the Station. The MMOD related Hazard Reports 
(HRs) that were used to determine that all possible hazards accounted for during the modeling 
phase are listed in Appendix A. The MMOD ESDs included in the integrated SAPHERE model 
are shown graphically in Appendix B. The fault tree models used are shown in Appendix C. 

The overall objective of the ISS MMOD protection program is to develop and deploy the ISS to 
safely operate in the MMOD environment by protecting the crew, protecting critical hardware, 
and minimizing degradation of subsystems. The ISS MMOD protection requirements should 
comply with the ISS protection principle: 

• Prob ability of no catastrophic failure (PNCF) requirement for 10 years is to meet/exceed 0.95 

• Risk of catastrophic failure for 1 0 years to not exceed 5 % 

2 Assumptions 

• All orbital debris larger than 1 0 cm is tracked by a ground station, and trajectory of this 
debris can be plotted accurately to determine if a potential collision with ISS is likely. 

• ISS debris shielding will prevent penetration by orbital debris smaller than from 0.2 cm to 
1.3 cm depending on the module or element (and assuming orbital debris is aluminum). 

• ISS is vulnerable to penetration by orbital debris between the capability of the shielding and 
the collision avoidance limit. Risk mitigation in event of penetration includes crew 
procedures to locate and isolate the leak, or evacuate the ISS if there is insufficient time to 
isolate the leak. 

• ISS avoids collision with orbital debris by performing a reboost maneuver, using the Service 
Module (SM) reboost engines or the Progress main engines. 

• If penetration of an ISS module pressure shell occurs, and the hole is small enough, the 
module can be isolated by the crew by closing the hatches to other modules, to prevent loss 
of atmosphere for the entire Station. 

• If the crew must isolate a leaking module from the rest of the ISS, there is a rapid means to 
remove drag-through cables and ducts that would otherwise prevent hatch closure. 

• Hatch mechanism failure which would prevent module isolation was considered to be very 
low probability and was not included in the MMOD PRA models. 

• Propulsion system failure which would prevent tracked debris avoidance was considered 
very low probability, and was not included. 
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3 Tracked and Untracked Orbital Debris Risks 

Based on the size of the debris, the Space Station MMOD risk analysis was divided into two 
categories: tracked orbital debris (OD) and untracked MMOD. If a tracked OD particle was 
predicted to have greater than a IE-4 probability of impacting the ISS, the Operational Flight 
Rules require a debris avoidance maneuver to be performed by the ISS. The untracked MMOD 
risk was based on NASA’s meteoroid and orbital debris integrated threat assessment (see Ref. 2) 
which uses the most current hardware design and flight information available. Central to the 
MMOD risk assessment is the computer code “BUMPER-IP (see Ref. 3), which calculates the 
probability of no penetration (PNP) for a spacecraft based on the spacecraft geometry, shielding 
configuration and flight parameters. 



3.1 Tracked OD Risk 

Debris that is tracked is generally greater than ~10cm in size. Debris avoidance maneuvers use 
the reboost thrusters to move the Station out of the IE-4 probability debris path. The Station is 
prepared for the reboost maneuver when gr ound flight support personnel determine that the 
Station needs to perform an OD avoidance maneuver. If preparation of the Station for OD 
avoidance or execution of the maneuver commands fails, the OD avoidance maneuver will not 
be performed. Failure to move out of the predicted path of the debris could result in OD hitting 
the Station. This is considered a very low likelihood event, and is not included in the PRA 
model. 


3.2 Untracked MMOD Risks 

Debris that is too small to track, but large enough to cause damage to the ISS is considered 
“untracked MMOD”. All micrometeoroids, of any size large enough to penetr ate the shielding 
of ISS modules and critical elements, are considered “untracked MMOD”. In this situation, 
there will be no debris avoidance maneuver to move the Station out of the debris path, resulting 
in MMOD hitting the Station. The severity of the impact is modeled in three event sequence 
diagrams (ESD). 

It should be noted that “penetration” at a minimum causes a pressure leak in a habitable module 
or external pressure vessel or propellant tank. A module penetration can cause crew loss or 
injury from the internal fragments and secondary effects of the penetration, and would be 
counted as a catastrophic failure even if the leak is isolated and ISS is not lost Catastrqrtiic 
failure is loss of ISS or crew if MMOD penetration of the pressure shell occurs. Catastrophic 
failure does not include injury of crew, evacuation of crew, loss/isolation of parts of ISS, or 
depress of the entire ISS, if the crew is evacuated successfully. Catastrophic failures are a subset 
of penetrations. Loss modes included in the catastrophic failure group are: crew injury /death, 
hypoxia, module/tank leakage thrust induced failures, critical equipment loss and module 
unzipping. 

3.2.1 Evacuation due to MMOD (EVAC-MMOD) 

If MMOD damage to the ISS is severe enough to cause loss of a critical system necessaiy for ISS 
survival, or if a MMOD penetration causes depressurization at a rate that does not leave enough 
time to isolate the leak 1 , then crew evacuation is necessary. Evacuation due to MMOD 
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penetration (EVAC-MMOD) is defined as ISS crew evacuating, leaving the ISS unmanned The 
ISS may be able to maintain a stable orbit altitude and attitude, and maintain module atmosphere 
with ground commanding for a long period, to permit docking and reinhabiting the ISS later. 
This endstate includes the following scenarios: 

1 . SM d epr es sur izat ion 

2. Crew non-fatal injury from penetrating particle impact 

3. Loss of ISS attitude control 

This is depicted in Figure 3-4 as the blue circle. 

If an Orbiter is docked to the ISS, it will be used for evacuation. If not, then the Soyuz will be 
used to evacuate the crew. The mean probability used for each of these pivotal events was 
calculated as shown in Section 4, to model the probability that the crew can evacuate. Failure to 
undock and failure of the vehicles to return the crew to earth after undocking was considered out 
of scope of the PRA, and is not included in the model. If evacuation via either vehicle is not 
possible, the event sequence ends in Loss of Crew (LOC). 



Figure 3-1. Event Sequence Diagram: MMOD-Untracked-EVAC 


3.2.2 Loss of Crewdue to MMOD (LOC-MMOD) 

If MMOD penetration of the ISS pressure shell occurs, then crew loss may occur as a result of 
the internal fragments and secondary effects of the penetration, and would be counted as a 
catastrophic failure even if the leak is isolated and ISS is not lost. 



Figure 3-2. Event Sequence Diagram: MMOD-Untracked-LOC 
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Loss of Crew due to MMOD penetration (LOC-MMOD) is defined as loss of one or more 
crewmembers without loss of the ISS. The endstate includes the following scenarios: 

1. Module unzip 

2. External equipment catastrophic failure 

3. Internal equipment catastrophic failure 

4. Large hole in module (hypoxia) 

5. Crew fatal injur} 7 from penetrating particle impact 

6. Gas release thrust causes collision during departure 

This is depicted in Figure 3-4 as the yellow circle. 

3.2.3 Loss of Crew and Vehicle due to MMOD (LOCV-MMOD) 

If MMOD damage to the ISS is severe enough to cause rapid depressurization of the ISS or 
external pressurized tank explosion and fragmentation, there would be insufficient time for crew T 
evacuation. This would be due to a large debris impact hole in a module or pressurized tank. 
This scenario would result in complete loss of ISS and loss of the crew. 




Figure 3-3. Event Sequence Diagram: MMOD -Untra eke d-LOCV 

Loss of Crew and Vehicle due to MMOD penetration (LOCV-MMOD) is defined as loss of crew 
arid loss of vehicle. The event happens so rapidly that the ISS crew has insufficient time to 
evacuate or perform corrective action to mitigate the hazard. This endstate includes the 
following scenarios: 

1. Module unzip 

2. Gas release thrust causing collision during departure 


This is depicted in Figure 3-4 as the orange circle. 
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Figure 3-4. Venn diagram showing relationship ofMMOD endstates. 


4 Evacuation Vehicle Availability Quantification 

4.1 Soyuz Evacuation Vehicle 

The Russian-provided Soyuz vehicle is always present while the ISS is manned, so the 
probability of Soyuz unavailability for evacuation was the complement of the vehicle availability. 

P s = 1 - (R) (Equation 4-1) 


Where, 

Ps = Unavailability of Soyuz for ISS evacuation 
R = Reliability of Soyuz vehicle 

4.2 Orbiter Evacuation Vehicle 

The Orbiter is not always present for ISS crew evacuation. It was assumed that the Orbiter can 
evacuate any ill or injured ISS crew. One distinct advantage with the Orbiter is that only the ill 
or injured ISS crewmember would have to leave. The Orbiter crew could tend to the ill 
crewmember during the return flight, and the Soyuz would remain docked as a lifeboat for the 
remainder of the ISS crew. Mean probability of Orbiter availability to perform an evacuation 
was determined by the total hours expected during the mission for an Orbiter to be docked at the 
Station divided by the total ISS mission hours. 


Po= 1 - (O/T) 


(Equation 4-2) 


Where, 

Po = Unavailab ility of Orb iter for ISS ev acuation 
T = Total mission time (6 months) 

O = Time on orbit (2 docked missions at 14 days each) (Ref. 8) 

This event used a normal probability distribution, based on expert judgment. 
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5 MMOD Penetration Analysis 

MMOD risks are subject to change based on: 

• Modification of ISS assembly sequence 

• Time exposed to MMOD 

• Changes in MMOD environment models 

• Refining of ballistic limit equations 

• Extent and timing of MMOD augmentation shields added to ISS elements 

• Changes in Soyuz/Pr ogress protection 

• Updated PNP or R-f actor assessments 

5.1 Assumptions 

1. The MMOD penetration analysis is based on the 10-year PNP & PNCF assessment during 
the time period of 2007-2016 (Ref. 2). 

2. Environment models used include: ORDEM2000 orbital debris, SSP30425B micro- 
meteoroid 

3. SM augmentation completed over 4 years: 12A.1 conformal panels, SM solar arrays vertical 
in 2007, SM deployable wings by 2010 (ULF4 or ULF5). 

4. No Soyuz or Progress MMOD enhancement will be performed. 

5. The Russian MLM module and MLM airlock meet the PNP requirements in the RS 
specification. 

6. One Progress is docked continuously to ISS, and a second Progress 70% of the ISS mission 
time. 

7. One Soyuz is docked to the ISS throughout the mission. 

8. An Orbiter will be docked to the ISS for 14 days per mission eveiy three months (Ref. 8). 

9. The PRA assessment is based on an assembly complete configuration. 

It should be noted that there was no uncertainty distribution available in the current ISS PNP & 
PNCF results obtained from the ISS MMOD Protection Subsystem Manager. Unless otherwise 
noted, a lognormal distribution with Error Factor (EF) of 5.0 was used in the MMOD PRA 
events. 

5.2 Definitions 

5.2.1 Probability of No Penetration (PNP) 

PNP is the probability that no part of the ISS will be penetrated by MMOD. PNP is calculated 
by the computer code “BUMPER-Il” (Ref. 2) and the R-factor is derived by the computer code 
“MSC-Surv” (Ref. 3). 

5.2.2 R-factor 

The R-factor is used to calculate Probability of No Catastrophic Failure (PNCF) for catastrophic 
risks. The R-factor was derived from assessment of all system and structural failures caused by 
MMOD penetration which would result in catastrophic internal effects for the crew and/or the 
ISS. These catastrophic failure modes include: unzipping of crew module wall, hypoxia of crew, 
fragmentation of external pressure vessels, fragmentation/release of hazardous materials from 


NESC Request No.:TI-09-00592 


© 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

09-00592 

Version: 

1.0 

Independent Review of US and Russian PRAs for 
MRM2 MMOD Risk 

Page #: 

54 of 91 



Booz | Allen | Hamilton 


SRACEH/AB 


damage of internal hardware, and venting/loss of attitude control during evacuation. It should be 
noted til at penetration of a habitable module results in external atmospheric leakage. 

5.2.3 Probability of No Catastrophic Failure (PNCF) 

The Prob ability of No Catastrophic Failure (PNCF) due to penetration was calculated using PNP 
and R-factor: 


PNCF = (PNP) R 


(Equation 5-1) 


Where: 

PNP = Probability of No Penetration of MMOD shielding 

R = Reduce Loss Factor R (the ratio of catastrophic penetrations to all penetrations) 

5.3 MMOD Critical Elements on ISS 

The locations of internal and external critical equipment assumed in the R-factor study are 
presented in Figure 5.1 below. This equipment is broken out by type: 

• Russian cooling equipment 

• Russian GN&C equipment 

• External critical equipment 

• Internal payloads (1 7.8% critical) 

• Internal stowage (10% critical) 

• Rack close-out (non -critical) 

• Critical internal systems (100%) 

• Internal non- critical systems 

Note that several modules have significant portions of their exterior covered by critical external 
equipment. The large percentage of exposed external critical equipment elements for these 
modules, compared to the total elements, is reflected in Appendix D (Table D-D-l, Table D-D-2, 
Table D-D-3). 
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EXTERNAL AND INTERNAL EQUIPMENT 



Key Region 
Progress 
Pnylnad T osses 
17.8% Critical 
(versus 69% in 
original 
baselme) 


«i 


if* 



Kotc: The 
assumption that 
iriern.nl payloads are 
69% critical is still 
used on payloads on 
all modules other 
than Progress 


* * 

Key Region 
Payload Losses 
1 7 8% Critical 
( versus 69“ o in 
original 
baseline! 



RtJRWMi 
r/VY IMP 
EQUIPMENT 



tJOT.GOITICAL 


iNTEHMW. 

HA T LUTJJt> 


K-ERNAJ. 

STORAGE 

IU % Ck- IKKL 

HACK 
ULLKiLUL'l 
S.TN nn 7TCAI 


IKTIWWL 

SYSTEMS 

100HGRTKTO. 

*. t-m. 
SVr.TPMf! 
NONcnmcA. 


MOCRTICAL 

EQJFMEM 


Figure 5-1. MMOD Critical Elements on ISS 


5.3.1 Determining the R-factor 

Within MSC-Surv, all critical external elements are marked with a “flag” (identifier used by the 
MSC-Surv program). The characteristics and failure conditions for the external tanks and tank 
lines modeled in the assessment is shown in Appendix D, Table D-D-l. The program calculates 
the likelihood that a Criticality 1 internal system element is impacted by debris spray from the 
penetration of the pressure wall. To perform these calculations accurately, the analyst must 
identify all Critical 1 and integral (dangerous producing) internal system elements aboard ISS 
manned modules. The analyst then must associate each of these internal systems with one or 
more external elements in MSCSurv’s data files. The percentage of critical internal systemic 
equipment elements for these modules, compared to the total elements are reflected in Appendix 
D, Table D-D-2 and Table D-D-3. In the current assessment, only those internal systems racks 
identified as being Critical 1 can result in critical failure if penetrated. 

5.3.2 Crew Location 

The crew location by day was determined by drawing random numbers for each penetration to 
determine where each crewmember was when the penetration occurred based on a specified crew 
frequency. The estimated time spent in each module by an individual crewmember in an average 
day is shown in Appendix D, Table D-D-4. 
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5.4 MMOD Calculation for Each Loss Mode 

The MMOD calculation for catastrophic impacts for each catastrophic loss mode, as well as 
evacuation impacts for each evacuation loss mode is presented in the following table. This data 
was provided by the JSC Orbital Debris Program Office. 



Catastrophic Impacts (N/hr) for each catastrophic loss mode 

Evacuation Impacts (N/hr) for each 
evacuation loss mode 

Unzip 

(depress) 

External 

Equip 

catastrophic 

failure 

(depress) 

Internal 

Equip 

catastrophic 
failure 
(depress or 
crew loss 
from toxic 
release) 

Large 
hole in 
module 
cause 
hypoxia 
(depress) 

Internal 
effects 
(fragments, 
other) 
causes loss 
of crew 
(LOC) 

Thrust 

induced 

angular 

velocity 

causes 

LOC 

during 

departure 

Uncontrolled 

depress 

causing 

Service 

module 

depressur- 

ization 

Crew non- 
fatal injury 
from 
internal 
fragments 
and other 
penetration 
effects 

Loss of 
ISS 

attitude 

control 

7.39E-08 

5.30E-07 

8.38E-08 

1.81E-07 

7.96E-08 

6.91E-10 

7.03E-07 

3.37E-07 

3.52E-08 


Table 5-1. MMOD Calculation for Catastrophic and Evacuation Impacts. 


6 MMOD Event Tree Initiator Probabilities 

The probability of each initiating event occurring was determined utilizing data from the JSC 
Orbital Debris Program Office. This data provided totals for EVAC, LOC and LOCV based on a 
weighted average of the probability with respect to time on orbit for the individual 
module/component Failure rates for the PRA model were weighted in a similar fashion in order 
to accurately reflect the result totals from the JSC Orbital Debris Program Office. 
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Unzip (depress) 

Thrust induced 
angular velocity 
causes LOC 
during 
departure 

LOCV 

FGB 

2.75E-1 0 

0.00E+00 

2.75E-1 0 

MLM 

2.24E-1 0 

0.00E+00 

2.24E-1 0 

MLM AL 

0.00E+00 

0.00E+00 

0.00E+00 

DC 

0.00E+00 

0.00E+00 

0.00E+00 

SM 

3.36E-1 0 

2.02E-09 

2.35E-09 

Prog aft 

0.00E+00 

0.00E+00 

0.00E+00 

Prog nadir 

0.00E+00 

0.00E+00 

0.00E+00 

Soyuz 

0.00E+00 

0.00E+00 

0.00E+00 

Node 1 

3.75E-1 0 

0.00E+00 

3.75E-1 0 

PMA 1 

2.09E-1 1 

0.00E+00 

2.09E-1 1 

PMA 2 

8.24E-1 2 

0.00E+00 

8.24E-1 2 

PMA 3 

4.95E-1 2 

0.00E+00 

4.95E-1 2 

CMGs 

0.00E+00 

0.00E+00 

0.00E+00 

PCU 

0.00E+00 

0.00E+00 

0.00E+00 

Lab 

5.15E-10 

0.00E+00 

5.15E-10 

Airlock 

2.28E-09 

0.00E+00 

2.28E-09 

TCS-s 

0.00E+00 

0.00E+00 

0.00E+00 

TCS-p 

0.00E+00 

0.00E+00 

0.00E+00 

Orb iter 

3.94E-09 

0.00E+00 

3.94E-09 

Node 2 

1 .96E-09 

0.00E+00 

1.96E-09 

Columbus 

3.07E-09 

0.00E+00 

3.07E-09 

Node 3 

1 .30E-09 

0.00E+00 

1.30E-09 

Cupola 

5.33E-1 1 

0.00E+00 

5.33E-1 1 

MPLM 

1.37E-10 

0.00E+00 

1.37E-10 

ATV 

1 .37E-09 

0.00E+00 

1.37E-09 

JEM ELM 

1 .39E-09 

0.00E+00 

1.39E-09 

JEM PM 

2.20E-09 

0.00E+00 

2.20E-09 

HTV 

3.43E-1 0 

0.00E+00 

3.43E-1 0 


1.98E-08 2.02E-09 2.18E-08 


Table 6-1. LOCV Totals Based on Wei^ited Averages 
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Unzip (depress) 

Thrust induced 
angular velocity 
causes LOC 
during 
departure 

External Equip 
catastrophic 
failure (depress) 

Internal Equip 
catastrophic 
failure (depress 
or crew loss 
from toxic 
release) 

Large hole in 
module cause 
hypoxia 
(depress) 

Internal effects 
(fragments, 
other) causes 
loss of crew 
(LOC) 

LOC 

FGB 

2.75E-10 

0.00E-K30 

4.46 E-08 

8.24 E-10 

4.08 E-08 

2.75E-10 

8.68E-08 

MLM 

2.24E-10 

O.OOE+OO 

3.64 E-08 

6.72 E-10 

3.33 E-08 

2.24E-1 0 

7.08E-08 

MLM AL 

0.00E-KD0 

0.00E-HD0 

0.00E+00 

5.98 E-10 

3.80E-1 1 

9.49E-1 1 

7.31 E-10 

DC 

0.00E-KD0 

O.OOE+OO 

0.00E-HD0 

1.56 E-08 

9.87 E-10 

2.47E-09 

1.90E-08 

SM 

3.36E-10 

2.02E-09 

4.70 E-09 

1.01 E-08 

8. 18 E-08 

2.86 E-09 

1.02E-07 

Prog aft 

0.00E-K30 

O.OOE+OO 

6.73 E-08 

5.51 E-08 

O.OOE+OO 

1.38 E-08 

1.36E-07 

Prog nadir 

0.00E-K30 

O.OOE-iOO 

9.20 E-08 

7.52 E-08 

O.OOE+OO 

1.88 E-08 

1 86E-07 

Soyuz 

O.OOE-iOO 

0.00E-HD0 

3. 77 E-08 

0.00E-HD0 

8.33 E-08 

1.1 9 E-08 

1 33E-07 

Node 1 

3.75E-10 

O.OOE-iOO 

0.00E-HD0 

2.46 E-09 

9.90 E-10 

2.90E-10 

4.1 IE-09 

PMA 1 

2.09E-1 1 

O.OOE-iOO 

0.00E-HD0 

0.00E-HD0 

4.49E-10 

1.46 E-10 

6.17E-10 

PMA2 

8.24E-12 

0.00E-HD0 

O.OOE+OO 

0.00E-HD0 

2.09 E-10 

1.07E-1 1 

2.28 E-10 

PMA 3 

4.95E-12 

O.OOE-iOO 

O.OOE-fOO 

0.00E+00 

1.26 E-10 

6.43E-12 

1.37 E-10 

CMGs 

0.00 E+00 

O.OOE-iOO 

7.94E-08 

O.OOE+OO 

O.OOE+OO 

O.OOE+OO 

7.94 E-08 

PCU 

0.00 E+00 

0.00E-HD0 

1.43E-10 

0.00E+00 

O.OOE+OO 

O.OOE+OO 

1.43 E-10 

Lab 

5.15E-10 

O.OOE-iOO 

0.00E-HD0 

1.64 E-09 

3.57 E-09 

1.63 E-09 

7.36 E-09 

Airlock 

2.28E-09 

O.OOE-iOO 

O.OOE-iOO 

1.11E-10 

4.99 E-09 

1.11 E-10 

7.49 E-09 

TCS-s 

O.OOE+OO 

O.OOE-iOO 

9.14E-09 

O.OOE+OO 

O.OOE+OO 

O.OOE+OO 

9. 14 E-09 

rcs-p 

O.OOE+OO 

0.00E-HD0 

9.14E-09 

0.00 E-iOO 

O.OOE+OO 

0.00E-HD0 

9. 14 E-09 

Orb iter 

3.94E-09 

0.00 E+00 

2.75E-08 

O.OOE-riDO 

3.94 E-09 

3.94 E-09 

3.94 E-08 

Node 2 

1.96E-09 

0.00 E+00 

0.00E-HD0 

7.45E-1 1 

1.85 E-09 

1.36 E-10 

4.02 E-09 

Columbus 

3.07E-09 

0.00 E+00 

0.00E-KD0 

3.17E-09 

5.79E-09 

7.81 E-10 

1.28 E-08 

Node 3 

1.30E-09 

0.00E-HD0 

0.00E-HD0 

1.82E-10 

3.83E-09 

2.43 E-10 

5.55 E-09 

Cupola 

5.33E-1 1 

0.00E-HD0 

0.00 E-HDO 

0.00E-HD0 

5.68E-10 

1.32 E-10 

7.54 E-10 

MPLM 

1.37E-10 

0.00E+00 

0.00 E-iOO 

1.41E-10 

2.58E-10 

3. 48 E- 11 

5.71 E-10 

ATV 

1.37E-09 

0.00E-HD0 

9.61 E-09 

O.OOE-iOO 

1 .37 E-09 

1.37 E-09 

1.37 E-08 

JEM ELM 

1.39 E-09 

0.00E-KD0 

0.00 E-H30 

6.18E-10 

4.20E-09 

9.62E-11 

6.31 E-09 

JEM PM 

2.20 E-09 

0.00E-HD0 

0.00E-HD0 

1 .6 2 E-09 

5.36E-09 

5.93E-10 

9.77 E-09 

HTV 

3.43E-10 

0.00E-HD0 

2.40 E-09 

O.OOE+OO 

3.43E-10 

3.43E-1 0 

3.43E-09 i 


1 .98 E-08 

2.02 E-09 

4.20 E-07 

1.68 E-07 

2.78 E-07 

6.03E-08 

9.48E-07 


T ab le 6-2. LO C T ot als Based on W ei^ited Averages 
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Uncontrolled 
depress causing 
Service module 
depressurization 

Crew non- fatal 
injury from 
internal 

fragments and 
other 

penetration 

effects 

Loss of ISS 
attitude control 

EVAC 

FGB 

3.00E-08 

2.76E-1 0 

0.00E+00 

3.03E-08 

MLM 

2.45E-08 

2.25E-1 0 

0.00E+00 

2.47E-08 

MLM AL 

7.53E-09 

3.65E-1 1 

0.00E+00 

7.56E-09 

DC 

1.96E-07 

9.50E-1 0 

0.00E+00 

1 .97E-07 

SM 

4.39E-07 

2.22E-07 

4.61 E-08 

7.07E-07 

Prog aft 

3.03E-09 

1.21E-08 

0.00E+00 

1.5 IE-08 

Prog nadir 

4.13E-09 

1 65E-08 

0.00E+00 

2.07E-08 

Soyuz 

0.00E+00 

1 .52E-08 

0.00E+00 

1 .52E-08 

Node 1 

4.52E-09 

1.88E-10 

0.00E+00 

4. 7 IE-09 

PMA 1 

1.08E-09 

2.74E-1 1 

0.00E+00 

1.1 IE-09 ! 

PMA 2 

2.83E-10 

1.71E-12 

0.00E+00 

2.85E-1 0 

PMA 3 

1.70E-10 

1.03E-12 

0.00E+00 

1 .7 IE-10 

CMGs 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

PCU 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

Lab 

2.80E-09 

1 42E-09 

0.00E+00 

4.22E-09 

Airlock 

4.55E-09 

7.31E-1 1 

0.00E+00 

4.62E-09 

TCS-s 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

TCS-p 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

Orb iter 

2.46E-09 

2.46E-09 

0.00E+00 

4.92E-09 

Node 2 

3.59E-09 

1.38E-10 

0.00E+00 

3.73E-09 

Columbus 

4.40E-09 

8.05E-1 0 

0.00E+00 

5.20E-09 

Node 3 

5.74E-09 

2.26E-1 0 

0.00E+00 

5.96E-09 

Cupola 

7.97E-10 

3.65E-1 1 

0.00E+00 

8.33E-1 0 

MPLM 

1.14 E- 1 0 

1.14E-10 

0.00E+00 

2.28E-1 0 

ATV 

5.49E-09 

5.49E-09 

0.00E+00 

1.10E-08 

JEM ELM 

2.77E-09 

2.74E-1 1 

0.00E+00 

2.80E-09 

JEM PM 

4.52E-09 

6.95E-1 0 

0.00E+00 

5. 2 IE-09 

HTV 

1.37E-09 

1 .37E-09 

0.00E+00 

2.74E-09 


7.48E-07 

2.81E-07 

4.61 E-08 

1.08E-06 


Table 6-3. EVAC Totals Based on Weighted Averages 
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7 MMOD Model Results 

7.1 Mean and Distributions for End States 

Results from the MMOD PRA models are shown in Table 7-1. 



5 th percentile 

Mean 

95 th percentile 

LOC-MMOD 

2.128E-03 

4. 1 04E-03 

7.233-03 

LOCV-MMOD 

4.944E-05 

9.421 E-05 

1.655E-04 

EVAC-MMOD 

1.491E-03 

4.607E-03 

1. 133E-02 


Table 7-1. MMOD end state results. 


7.2 Error Factor 

Basic events were assigned failure rates based upon the information given for each module. 
As noted in section 5. 1, there was no uncertainty distribution available in the current ISS 
PNP & PNCF results obtained from the ISS MMOD Protection Subsystem Manager. 

It is recognized that some amount of uncertainty is inherent to any estimated failure rate. In 
order to establish an error factor for the ISS PRA MMOD model basic events the following 
considerations were evaluated. 

1. The Bumper-II Micrometeoroid and Orbited Debris Threat Assessment Code: 
Estimation of Or biter Uncertainty Bounds v2. 0 report was reviewed. 

2. A review of the Shuttle PRA (SPRA) methodology was useful since the MMOD 
analysis for the Shuttle included a detailed uncertainty analysis. In addition, the 
Shuttle PRA modeled MMOD events separately, in fault trees, similar to what is 
done in the ISS PRA. 

3. A paper by Bruce Reistle discussing the effect on error factor by combining basic 
event distributions titled “Shrinkage.” 

The Bumper-II report gives a final result for the Shuttle MMOD risk with 90% confidence 
bounds and a nominal value. Although the inputs to the simulation have various 
distributions, the result closely approximates a lognormal distribution with an error factor 
of 1.3. Since a similar uncertainty analysis has not yet been completed for the ISS MMOD 
PNP and PNCF information, it is reasonable to expect like results in the absence of other 
data. For this reason we would expect an error factor of 1.3 (or higher to be conservative) 
in the ISS PRA results. 

The SPRA utilized data provided in the MMOD risk analysis in the form of fault trees and 
event trees representing different vehicle sections and their associated risk in lieu of one 
overall result. This provided a higher level of fidelity in the SPRA model. Error factors for 
basic events were chosen such that die mean and distribution results from the SPRA model 
matched closely to the overall result provided by the MMOD analysis data. If an error 
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factor of 1.3 were chosen for each basic event for example, the resulting error factor for the 
results would be much lower than 1.3 due to shrinkage (Reistle, 2007) thus providing an 
unacceptable result. An error factor of 5 for the MMOD related basic events was ultimately 
chosen for the SPRA. 

The ISS PRA team considered using summary information from the ISS PNP & PNCF 
results. Since the information included results by individual module, it was decided to 
include the module level of detail in the SAPHIRE model. Probabilities for module 
penetration by MMOD are included in the model as basic events. This provides increased 
fidelity for the model such that individual modules can be easily added or removed and the 
results recalculated. It is anticipated that this will be helpful as plans for the ISS evolve and 
when specific h ade studies may be required. The mean values obtained from the 
SAPHIRE model results (Table 7-1) are also a match to the summary values in the ISS 
PNP & PNCF results. 

A sensitivity study was performed for the ISS PRA to determine the effect of different 
error factors for the MMOD related basic events. The error factor that would result from an 
assumed lognormal distribution for the end states was then compared against the expected 
error factor from the Bumper II report. The results are shown in Table 7-2. The error 
factors for the end state results were obtained by moment matching to a lognormal 
distribution using Equation 7-1. 


EF = 


9 5th(percentile) 
5th{perceniile) 


Equation 7-1 



EF for Basic Events 

3 

5 

10 

EF Result (Lognormal) 

End 

State 

LOC-MMOD 

1.49 

1.84 

2.55 

LOCV-MMOD 

1.47 

1.83 

2.55 

EVAC-MMOD 

2.05 

2.76 

3.94 


Table 7-2 


An error factor of 5 with a lognormal distribution was chosen for the ISS PRA MMOD 
model basic events. This establishes consistency with the SPRA methodology’ and provides 
appropriately conservative results for error factor when compared to the 1.3 error factor in 
the Bumper-II study. 
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A. Appendix A 


HR Number 

Title 

KhSC-004 

Depressurization ofthe body of the FGB 

KhSC-001 1 

Failure of high-pressure tanks, spheric bottles, elements, fittings, or lines. 

KhSC-0023 

Depressurization ofthe body ofthe FGB and its systems as a result of impact 
of meteoroids and space debris. 

RSCE-0022-03 

Hazards associated with the use of windows 

RSCE-0041-02 

Explosion in the SM 

RSCV-0006-03 

Inadvertent depressurization ofProgress-M modules 

RSCV-0021-03 

Penetration of pressurized compartments and damage to on-board systems 
ofProgress-M as a result of MMOD impact 

RSCE-C103 

Depressurization of DC1 pressurized compartments as a result of impact with 
a micrometeoroid or orbital debris. 

ISS-STR-1005-9A 

Loss of ISS Due to Micrometeoroid/Orbital Debris (MMOD) Impacts. 

RSTV-0009 
version 9 

Depressurization of pressurized compartments as a result of MMOD. 


Table A-l. MMOD Related Hazard Reports 


B. Appendix B 


Name 

Description 

Probability 

Unc 

Type 

Unc Value 1 

MMOD-UNTRACKED-EV AC-G1 

Untracked MMOD impact leads 
to crew evacuation 

1.580E-002 

N 

5. 000E+000 

MMOD-UNTRACKED-LOM-G1 

Untracked MMOD impact leads 
to loss of a module 

1 . 1 00E-002 

N 

5. 000E+000 

MMOD -UNTRACKED -LOS -G1 

Untracked MMOD leads to loss 
of ISS or crew 

4.090E-003 

N 

5. 000E+000 

ORBITER 

Orb iter not av ai 1 ab 1 e for 
evacuation 

8.466E-001 

L 

1.000E+001 

SOYUZ 

Soyuz not available for 
evacuation 

3.750E-003 

L 

1.000E+001 


Table B-l. Event Tree Initiating and Pivotal Event Data Used in SAPHIRE Model. 
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C. Appendix C 


W mm od -untrack ed-evac OR Untracked M MOD impact forces crew evacuation 

1 O EVAC-M MOD -AIRLOCK (1.996 E-0 05) Untracked MM OD impact to Airlock leads to evacuation of IS S 
I O EVAC-M MOD -ATV (4.752E-005) Untracked M MOD impact to ATV leads to evacuation of ISS 
K> EVAC-MMOD-COL (2.246E-005) Untracked M MOD impact to Columbus leads to evacuation of ISS 
hO EVAC-MMOD-CUP (3.599E-006) Untracked MMOD impact to Cupola leads to evacuation of ISS 
K> EVAC-MMOD-DC (8.507E-004) Untracked MMOD impact to DC leads to evacuation of ISS 
I O EVAC-MMOD-FGB (1.309E-004) Untracked MMOD impact to FGB leads to evacuation of ISS 
h-O EVAC-M MOD -HTV (1.184E-005) Untracked MMOD impact to HTV leads to evacuation of ISS 
I O EVAC-M MOD -JEM -ELM (1.21 0E-005) Untracked MMOD impact to JEM ELM leads to evacuation of ISS 
1—0 EVAC-M MOD -JEM -PM (2.251E-005) Untracked MMOD imp act to JEM PM leads to evacuation of ISS 
1 O EVAC-MMOD-LAB (1.823E-005) Untracked MMOD impact to Lab leads to evacuation of ISS 
I O EVAC-MMOD-MLM (1 067E-004) Untracked MMOD impact to MLM leads to evacuation of ISS 
I O EVAC-M MOD -MLM- AL (3.266E-005) Untracked MMOD impact to MLM AL leads to evacuation of ISS 
1—0 EVAC-M MOD -MPLM (9.850E-007) Untracked MMOD impact to MPLM leads to evacuation of ISS 
h-O EVAC-M MOD -N0DE1 (2.035E-005) Untracked MMOD impact to Node 1 leads to evacuation of ISS 

I O EVAC-M MOD -N0DE2 (1 .6 1 IE-005) Untracked MMOD impact to Node 2 leads to evacuation of ISS 

I O EVAC-M M0D-N0DE3 (2.575E-005) Untracked MMOD impact to Node 3 leads to evacuation of ISS 

I O EVAC-MMOD-ORB (2.125E-005) Untracked MMOD impact to Orbiter leads to evacuation of ISS 

\—0 EVAC-M MOD -PM A1 (4.795E-006) Untracked MMOD impact to PMA 1 leads to evacuation of ISS 

I O EVAC-M MOD -PM A2 (1.23 IE-006) Untracked MMOD impact to PMA 2 leads to evacuation of ISS 

hO EVAC-M MOD -PM A3 (7.387E-007) Untracked MMOD impact to PMA 3 leads to evacuation of ISS 

ho EVAC-M MOD -PROG-AFT (6.523E-005) Untracked MMOD impact to Progress Aft leads to evacuation of ISS 
K> EVAC-M MOD -PROG-NDR (8. 942 E- 00 5) Untracked MMOD imp act to Progress nadir leads to evacuation of ISS 
I O EVAC-MMOD-SM (3.050E-003) Untracked MMOD impact to SM leads to evacuation of ISS 
*— O EVAC-M MOD -SO YUZ (6.566E-005) Untracked MMOD impact to Soyuz leads to evacuation of ISS 

Figure C-C-l. EVAC Fault Tree 


W mmod-untracked-loc OR MMOD loss of crew due to untracked MMOD 

h" O LOC -MMOD- AIRLOCK (3.236E-005) Untracked MMOD impact to Airlock leads to loss of crew 
I O LOC-MMOD-ATV (5.918E-005) Untracked MMOD impact to ATV leads to loss of crew 
hO LOC -MMOD- CM G (3.430E-004) Untracked MMOD impact to CMGs leads to loss of crew 
K> LOC-MMOD-COL (5.529E-005) Untracked MMOD impact to Columbus leads to loss of crew 
ho LOC -MMOD- CUP (3.257E-006) Untracked MMOD impact to Cupola leads to loss of crew 
M3 LOC -M MOD- DC (8 .2 0 8E-0 05) Untracked MM OD imp act to DC leads to lo ss o f crew 
I O LOC-MMOD-FGB (3.749E-004) Untracked MMOD impact to FGB leads to loss of crew 
hO LOC -M MOD- HTV (1.482 E-0 05) Untracked MM OD imp act to HTV leads to loss o f crew 
I O LOC -M MOD- JEM -ELM (2 .72 6 E-0 0 5) Untracked M M OD imp act to JEM ELM leads to 1 oss o f crew 
I O LOC -MMOD- JEM -PM (4.221E-005) Untracked MMOD impact to JEM PM leads to loss of crew 
I O LOC-MMOD-LAB (3.180E-005) Untracked MMOD impact to Lab leads to loss of crew 
hO LOC-MMOD-MLM (3.058E-004) Untracked MMOD impact to MLM leads to loss of crew 
I O LOC -MMOD- MLM- AL (3.158E-006) Untracked MMOD impact to MLM AL leads to loss of crew 
I O LOC-MMOD-MPLM (2.467E-006) Untracked MMOD impact to MPLM leads to loss of crew 
I O LOC-MMOD-NODE1 (1.776E-005) Untracked MMOD impact to Node 1 leads to loss of crew 
I O LOC-MMOD-NODE2 (1.737E-005) Untracked MMOD impact to Node 2 leads to loss of crew 
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L0C-MM0D-N0DE3 (2.398E-005) Untracked MMOD impact to Node 3 leads to loss of crew 
LOC-MMOD-ORB (1.702E-004) Untracked MMOD impact to Orbiter leads to loss of crew 
LOC-MMOD-PCU (6.178E-007) Untracked MMOD impact to PCU leads to loss of crew 
LOC-MMOD-PMA1 (2.665E-006) Untracked MMOD impact to PMA 1 leads to loss of crew 

LOC-MMOD-PMA2 (9.850E-007) Untracked MMOD impact to PMA 2 leads to loss of crew 

LOC -M MOD- PM A3 (5.918E-007) Untracked MMOD impact to PMA 3 leads to loss of crew 

LOC -MMOD- PROG-AFT (5. 874E-0 04) Untracked MMOD imp act to Pro gress aft leads to 1 o ss o f crew 
LOC-MMOD-PROG-NDR (8.032E-004) Untracked MMOD impact to Progress nadir leads to loss of crew 
LOC-MMOD-SM (4.405E-004) Untracked MMOD impact to SM leads to loss of crew 
LOC-MMOD-SOYUZ (5.744E-004) Untracked MMOD impact to Soyuz leads to loss of crew 
LOC-MMOD-TCS-P (3.948E-005) Untracked MMOD impact to TCS-p leads to loss of crew 
LOC -M MOD-TCS -S (3 . 948 E- 00 5) Untracked MMOD imp act to TC S- s 1 eads to lo ss of crew 

Figure C-2. LOC Fault Tree 



W mmo d -untrack ed-locv OR Loss of crew and vehicle due to untracked MMOD 

I O LOC V-M MOD-AIRLOCK (9.850E-006) Untracked MMOD imp act to Airlock leads to loss of crew and IS S 
I O LOCV-MMOD-ATV (5.918E-006) Untracked MMOD impact to AW leads to loss of crew and IS S 

I O LOCV-MMOD-COL (1.326E-005) Untracked MMOD impact to Columbus leads to loss of crew and IS S 

H O LOC V-M MOD-CUP (2.303E-007) Untracked MMOD impact to Cupola leads to loss of crew and 1SS 
HO LOCV-MMOD-FGB (1.1 88E-006) Untracked MMOD impact to FGB leads to loss of crew and ISS 

I O LOCV-MMOD-HW (1.482E-006) Untracked MMOD impact to HW leads to loss of crew and ISS 

\~ O LOC V-M M OD-JEM -ELM (6.005E-006) Untracked MMOD impact to JEM ELM leads to loss of crew and ISS 
h^O LOCV-MM OD-JEM -PM (9.504E-006) Untracked MMOD impact to JEM PM leads to loss of crew and ISS 
K> LOC V-M MOD-LAB (2.225E-006) Untracked MMOD impact to Lab leads to loss of crew and ISS 
hO LOCV-MMOD-MLM (9.677E-007) Untracked MMOD impact to MLM leads to loss of crew and ISS 
h"0 LOCV-MM OD-MPLM (5.918E-007) Untracked MMOD impact to MpLM leads to loss of crew and ISS 
I O LOCV-MMOD-NODE1 (1.620E-006) Untracked MMOD impact to Node 1 leads to loss of crew and ISS 

I O LOCV-MM OD-NODE2 (8.467E-006) Untracked MMOD impact to Node 2 leads to loss of crew and ISS 

I O LOCV-MMOD-NODE3 (5.616E-006) Untracked MMOD impact to Node 3 leads to loss of crew and ISS 

I O LOCV-MMOD-ORB (1.702E-005) Untracked MMOD impact to Orbiter leads to loss of crew and ISS 

1“0 LOCV-MM OD-PMA1 (9.029E-008) Untracked MMOD impact to PMA 1 leads to loss of crew and ISS 

I O LOCV-MMOD-PMA2 (3.560E-008) Untracked MMOD impact to PMA 2 leads to loss of crew and ISS 

1-^0 LOC V-M M OD-PM A3 (2.138E-008) Untracked MMOD impact to PMA 3 leads to loss of crew and ISS 

L ~0 LOCV-MM OD-SM (1.015E-005) Untracked MMOD impact to SM leads to loss of crew and ISS 

Figure C-3. LOCV Fault Tree 
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D. Appendix D 


Tank 

PID 

Module 

item 

Explosive 

Flag 

Max. 

Thrust 

Critical 

Crack 

Length 

(in) 

Tank Characterization 

16 

Service 

M2 Tank 

0 

1000 lbs 

1.00 

35t$psi. Ti 3T3-1 , 3.75 rm thick 340mm C a sphere 

17 

Service 

UDMH Prep. Tank 1 &2 

• 

1000 lbs 

0.-8 

338psi, SS301 1.2mm thick, 600mm, cylinder 

18 

Service 

M204 Oxidizer Tank 3 & 4 

D 

1000 lbs 

0.43 

338psi,SS301 1.2mm thick, SCCmm, cylinder 

15 

FGB 

M2 Tank 

D 

1000 lbs 

1.76 

3556psi. Ti 5T14, 6.6 mm thick, 426mm Da sphere 

3 

FGB 

UDMH ^ropellant Tank 

1 

1000 lbs 

1.81 

32Spsi, At/GG 2.45mm thick 690mm, cylinder 

11 

FGB 

M204 Oxidizer Tank 

0 

1000 lbs 

1.81 

328psi, AMGG 2.45mm thick SSCmm, cylinder 

5 

FGB 

Propellant Tank Lines 

1 

1000 lbs 

7.74 

233psi, SS30 1 2mm thick Icm OD 

6 

FGB 

Oxidizer "ank Lines 

0 

1000 lbs 

7.74 

233psi, S5301 2mm thick 1cm OD 

7 

Progress 

Air Tanks 

0 

1000 lbs 

0.94 

5264psi, Ti, 5.4mm thick. 338mm Dia sphere 

8 

Progress 

Forward He T ank 

0 

1000 lbs 

0.62 

5264psi, Ti, 5.4mm thick, 338mm Dia sphere 

13 

Prog r ess 

Forward Propellant "ank 

1 

1003 lbs 

1.54 

398psi, AI/GG 3.7mm thick. 754rrr Cia, cylinder 

U 

Progress 

Fop;/arc Oxidizer Tank 

Q 

1000 lbs 

1.04 

398psi, AMG6 3.7mm thios 754trm Dia. cylinder 

9 

Prog -ess 

AFT Propel ant Tank 

1 

1000 lbs 

0.97 

384psi, AMG6. 2.5mm thick 753nrm Cia, cylinder 

8 

Prog-ess 

AFT he Tank 

0 

1000 lbs 

0.02 

52G4psi, Tj, 5.4mm thick, 338mm Dia sphere 

10 

Progress 

AFT Oxidizer Tank 

0 

1030 lbs 

0.97 

3B4psi, AMGG 2.5mm thick 753mm Cia. cylinder 

7 

SOYUZ 

Forv/arc Air Tank 

0 

1000 lbs 

0.94 

5264psi. Ti, 5.4mm thick, 338mm D a sphere 

9 

sovuz 

AFT Propel ant Tank 

1 

1000 lbs 

0.97 

3B4psi. AMG6. 2.5mm thick 75Dmm Dia, cylinder 

8 

SOVUZ 

AFT he or M2 Tark 

0 

1000 lbs 

0.62 

52G4psi, Tj, 5.4mm thick. 338mm D a sphere 

10 

SOVUZ 

AFT Oxid zer Tank 

□ 

1000 lbs 

0.97 

3B4psi. AMGG 2.5mm thick 750rrm Dia. cylinder 

3 

UDM 

UDMH Propellant Tank 

1 

1000 lbs 

1.81 

328psi, At/GG, 2.45mm thick 69Cmm, cylinder 

11 

JDM 

Oxicizer T ank 

0 

1000 lbs 

1.81 

328psi, AMG6, 2.45mm thick 690mm, cylinder 

4 

JDM 

M2 Tank 

0 

1000 lbs 

0.41 

4979psi, Tj BT3-1, 5.4 mm thick 426mm Cia, sphere 

12 

HPGC 

M2 & 02 Tan-ts 

0 

1000 lbs 

0.65 

4875psi, .066 Inc. 718, 1 E-Gass, 38 64' Dia sohere 


Table D-D-l. External Critical Elements by Type 
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Module 

Flag 

Flag Descriptiou 

U of 

Elements 

%of 

Elements 

Total 

Elements 

FOB 

0 

Non-cntical Internal Equipment or No Equipment 

1970 

40.53 

4860 


1 

Internal Pres bottles. 100°o critical 

18 

0.37 



3 

External UDMH Prop Tank 

1216 

25.02 



5 

External Propellant Tank 

80 

1 65 



6 

External Oxidizer Tank 

40 

0.82 



11 

External X : 0 4 Oxidizer Tank 

1216 

25.02 



15 

External Nitrogen Tank 

172 

3.54 



30 

External Compressor 

14S 

3 05 


Service (Aft) 

0 

Non-cntical Internal Equipment or No Equipment 

6762 

78.44 

8621 


1 

Internal Systems, 100°o cntical 

158 

1.83 



16 

External NO : Tank 

64 

0.74 



17 

External Propellant Tank 

24 

028 



18 

External Oxidizer Tank 

24 

0 28 



30 

External Compressor 

120 

1.39 



95 

Critical GN&C Equipment 

71 

0.82 



96 

Coolant Loops Critical for GN&C 

1398 

16.22 


UDM 

0 

Non-cntical Internal Equipment or No Equipment 

2729 

75.76 

3602 


1 

Internal Pres bottles. 100°o cntical 

25 

0.69 



3 

External UDMH Prop Tank 

300 

8.33 



4 

External Nitrogen Tank 

248 

6 89 



11 

External N ; 0 4 Oxidizer Tank 

300 

8.33 


SSP1 

0 

Non-cntical Internal Equipment or No Equipment 

2636 

95.58 

2758 


1 

Internal Pres bottles. 100°o cntical 

12 

0.44 



96 

Coolant Loop Components (GN&C Cnt) 

110 

399 


Docking Comp 

0 

Non-cntical Internal Equipment or No Equipment 

388 

96 04 

404 


1 

Internal Pres bottles. 1 00° o cntical 

16 

396 


Progress 

0 

Non-cntical Internal Equipment or No Equipment 

1424 

38.44 

3704 


2 

Internal Payload. 69° o cntical 

540 

14.58 



7 

External Air Tank 

1152 

31 10 



S 

External AFT Helium or N ; Tank 

152 

4.10 



9 

External AFT Prop. Tank 

144 

3.89 



10 

Exteranl AFT Oxidizer Tank 

84 

2.27 



13 

External Forward Prop Tank 

120 

3.24 



14 

External AFT Prop Tank 

72 

194 



20 

External Batteries 

16 

0.43 


Service (Fwd) 

0 

Non-cntical Internal Equipment or No Equipment 

334 

93.30 

358 


96 

Coolant Loops Critical for GN&C 

24 

6 70 


Sovuz 

0 

Non-cntical Internal Equipment or No Equipment 

3S04 

85 68 

4440 


7 

External Air Tank 

288 

6.49 



8 

External AFT Helium or N : Tank 

102 

2 30 



9 

External AFT Prop Tank 

144 

3.24 



10 

External AFT Oxidizer Tank 

86 

1 94 



20 

External Batteries 

16 

036 



Table D-D-2. Internal and External Critical Elements by Type (RSA Modules) 
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Module 

Flag 

Flag Descrlpdon 

it of 

Elements 

%of 

Elements 

Total 

Elements 

Node 2 

0 

Non-cntical Internal Equipment or No Equipment 

2576 

92.53 

2784 


l 

Internal systems, non-critical 

76 

2.73 



1 

Interna: systems 10(1% critical 

28 

1.01 



i 

Lrtcmal Stowage, 10% critical 

104 

3.74 


JEM PM 

0 

Non-cntical Internal Equipment or No Equipment 

556 

75.14 

740 


l 

interna, systems, non-critical 

56 

7.57 



l 

Internal systems, 10C% critical 

8 

1.08 



2 

I item a Payload Closeout. 0% critical 

64 

8.65 



2 

Internal Payload. 69% critical 

56 

7.57 


JEM ELM 

0 

Nuu-cnlical Internal Equipment ui No Equipment 

160 

7L.43 

224 


l 

internal systems, 100% critical 

8 

3.57 



2 

Internal Payload Closeout. 0% critical 

32 

14.29 



2 

I iternal Stowage. 10% critical 

24 

10.71 


US LAB 

0 

Non-cntical Internal Equipment or No E quipment 

1123 

66.20 

1701 


l 

Internal systems, non-critical 

264 

15.49 



L 

Internal systems, 100% critical 

24 

1.41 



2 

Internal Payload Closeoui. 0% critical 

72 

4.23 



2 

Internal Stowage. 10% critical 

48 

2.62 



2 

Internal Payload 69% critical 

168 

9.86 


Nude 1 

0 

Non-critical Internal Equipment or No Equipment 

2883 

96.52 

2992 


L 

Ertemal systems. 10C% critical 

24 

0.80 



2 

Internal Stowage. 10% critical 

80 

2.6 7 


IIP Tanks 

12 

External High Pressure Tanks 

252 

100.00 

252 

Airlock 

0 

Nun-critical Internal Equipment or No Equipment 

1521 

92.46 

1645 


l 

Ertemal systems, non-critical 

92 

5.59 



l 

Internal systems, 10C% critical 

32 

1.95 


PMA 1 

0 

Non-cntical Internal Equipment or No Equipment 

880 

100 00 

880 

P.VLA 2 

0 

Non-cntical Internal Equipment or No Equipment 

884 

100.00 

884 

PMA 3 

0 

Non-cntical Internal Equipment or No Equipment 

964 

100.00 

964 


Table D-D-3. Internal and External Critical Elements by Type (NASA Modules) 
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Very Low Occupancy 

Low Occupancy 

Module 

Factor 

Ave. 

hours per 
day 

Ave. 
minutes 
per day 

Module 

Factor 

Ave. 

hours per 
day 

Ave. 
minutes 
per day 

AIRLOCK 

0.25 

0.301887 

18 

NODE 1 

1 

1.207547 

72 

DK COMP 

0.25 

0.301887 

18 

NODE 2 

1 

1.207547 

72 

JEM ELM 

0.25 

0.301387 

18 

UDM 

1 

1 207547 

72 

PMA 2 

0.1 

0.120755 

7 

FGB 

1 

1 207547 

72 

PMA_3 

0.1 

0.120755 

7 

PMA_1 

0.5 

C. 503774 

36 

PROG 

0.1 

0.120755 

7 

SERVFWD 

0.5 

0.603774 

36 

SOYUZ 

0.1 

0.120755 

7 





SPP 1 

0.1 

0.120755 

7 






High Occupancy 

Very High Occupancy 

/ 

Module 

Factor 

Ave. 

hours per 
day 

Ave. 
minutes 
per day 

Module 

Factor 

Ave. 

hours per 
day 

Eve! 
minutes 
per day 

IJS LAB 

2 

2 415094 

145 

SERVAFT 

35 

4 226415 

254 

JEM PM 

1.5 

1.811321 

109 






Total per day 16 960 

Table D-D-4. Estimated Time Spent in Each Module by an Individual Crewmember in an Average “Day” 
(Note: This does not include sleeping period during crew “nigfit”) 
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E. Appendix E 


Catastrophic Impacts (N/hr) for each catastrophic loss mode 



Unzip (depress) 

External Equip 
catastrophic 
failure (depress) 

Internal Equip 
catastrophic 
failure (depress 
or crew loss from 
toxic release) 

Large hole in 
module cause 
hypoxia 
(depress) 

Internal effects 
(fragments, 
other) causes 
loss of crew 
(LOC) 

Thrust induced 
angular velocity 
causes LOC 
during departure 

FGB 

2.75E-1 0 

4.46E-08 

8.24E-10 

4. 08 E-08 

2.75E-10 

0.00E+00 

MLM 

3.20E-10 

5.20E-08 

9.61E-10 

4.75E-08 

3.20E-10 

0.00E+00 

MLM AL 

0.00E+00 

0.00E+00 

8.54E-1 0 

5.42E-1 1 

1.36E-10 

0.00E+00 

DC 

0.00E+00 

0.00E+00 

1.56E-08 

9.87E-10 

2.47E-09 

0.00E+00 

SM 

3.36E-10 

4.70E-09 

1.0 IE-08 

8.18E-08 

2.86E-09 

2.02E-09 

Progress aft 

0.00E+00 

6.73E-08 

5.51 E-08 

0.00E+00 

1 .38E-08 

0.00E+00 

Progress 

nadir 

0.00E+00 

1.3 IE-07 

1.07E-07 

0.00E+00 

2.69E-08 

0.00E+00 

Soyuz 

0.00E+00 

3.77E-08 

0.00E+00 

8.33E-08 

1.19E-08 

0.00E+00 

Node 1 

3.75E-1 0 

0.00E+00 

2.46E-09 

9.90E-10 

2.90E-10 

0.00E+00 

PMA 1 

2.09E-1 1 

0.00E+00 

0.00E+00 

4.49E-10 

1.46E-10 

0.00E+00 

PMA 2 

8.24E-1 2 

0.00E+00 

0.00E+00 

2.09E-10 

1.07E-11 

0.00E+00 

PMA 3 

4.95E-12 

0.00E+00 

0.00E+00 

1.26E-10 

6.43E-12 

0.00E+00 

CMGs 

0.00E+00 

7.94E-08 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

PCU 

0.00E+00 

1.43E-10 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

Lab 

5.15E-10 

0.00E+00 

1.64E-09 

3.57E-09 

1.63E-09 

0.00E+00 

Airlock 

2.28E-09 

0.00E+00 

1.1 IE-10 

4.99E-09 

1 .1 IE-10 

0.00E+00 

TCS-s 

0.00E+00 

9.14E-09 

0.00E+00 

0.00E+00 

0.00E + 00 

0.00E+00 

TCS-p 

0.00E+00 

9.14E-09 

0.00E+00 

0.00E+00 

0.00E+00 

0.00E+00 

Orbiter 

1 .50E-07 

1 05E-06 

0.00E+00 

1.50E-07 

1.50E-07 

0.00E+00 

Node 2 

2.18E-09 

0.00E+00 

8.27E-1 1 

2.05E-09 

1.52E-10 

0.00E+00 

Columbus 

3.4 IE-09 

0.00E+00 

3.53E-09 

6.44E-09 

8.68E-10 

0.00E+00 

Node 3 

1 .62E-09 

0.00E+00 

2.28E-1 0 

4.79E-09 

3.04E-10 

0.00E+00 

Cupola 

6.67E-1 1 

0.00E+00 

0.00E+00 

7.10E-10 

1.65E-10 

0.00E+00 

MPLM 

4.16E-08 

0.00E+00 

4.30E-08 

7. 84 E-08 

1 .06 E-08 

0.00E+00 

A TV 

4.64E-09 

3.25E-08 

0.00E+00 

4.64E-09 

4.64E-09 

0.00E+00 

JEM ELM 

1 .54E-09 

0.00E+00 

6.87E-1 0 

4.67E-09 

1.07E-10 

0.00E+00 

JEM PM 

2.44E-09 

0.00E+00 

1.81E-09 

5.95E-09 

6.59E-10 

0.00E+00 

H7V 

4.17E-09 

2.92E-08 

0.00E+00 

4.17E-09 

4.17E-09 

0.00E+00 

ISS Total 

7.39E-08 

5.30E-07 

8.38E-08 

1.81 E-07 

7.96E-08 

6.91E-10 


Table E-E-l. Catastrophic Impacts (N/hr) for Each Catastrophic Loss Mode 
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Evacuation Impacts (N/hr) for each evacuation 
loss mode 


Uncontrolled 
depress causing 
Service module 
depressurization 

Crew n on-fatal 
injury from 
internal 

fragments and 
other penetration 
effects 

Loss of ISS 
attitude control 

FGB 

3.00E-08 

2.76E-10 

0.00E+00 

MLM 

3.50E-08 

3.21 E-10 

0.00E+00 

MLM AL 

1.08E-08 

5.22E-1 1 

0.00E+00 

DC 

1.96E-07 

9.50E-10 

0.00E+00 

SM 

4.39E-07 

2.22E-07 

4.61 E-08 

Progress aft 

3.03E-09 

1.21E-08 

0.00E+00 

Progress 

nadir 

5.90E-09 

2.36E-08 

0.00E+00 

Soyuz 

0.00E+00 

1.52E-08 

0.00E+00 

Node 1 

4.52E-09 

1.88E-10 

0.00E+00 

PMA 1 

1.08E-09 

2.74E-1 1 

0.00E+00 

PMA 2 

2.83E-10 

1.71 E- 1 2 

0.00E+00 

PMA 3 

1.70E-10 

1.03E-12 

0.00E+00 

CMGs 

0.00E+00 

0.00E+00 

0.00E+00 

PCU 

0.00E+00 

0.00E+00 

0.00E+00 

Lab 

2.80E-09 

1.42E-09 

0.00E+00 

Airlock 

4.55E-09 

7.31E-11 

0.00E+00 

TCS-s 

0.00E+00 

0.00E+00 

0.00E+00 

TCS-p 

0.00E+00 

0.00E+00 

0.00E+00 

Orb iter 

9.35E-08 

9.35E-08 

0.00E+00 

Node 2 

3.99E-09 

1.54E-10 

0.00E+00 

Columbus 

4.89E-09 

8.94E-10 

0.00E+00 

Node 3 

7.17E-09 

2.83E-10 

0.00E+00 

Cupola 

9.96E-10 

4.57E-11 

0.00E+00 

MPLM 

3.47E-08 

3.47E-08 

0.00E+00 

ATV 

1.86E-08 

1.86E-08 

0.00E+00 

JEM ELM 

3.08E-09 

3.05E-1 1 

0.00E+00 

JEM PM 

5.02E-09 

7.72E-10 

0.00E+00 

HTV 

1.67E-08 

1.67E-08 

0.00E+00 

ISS Total 

7.03E-G7 

3.37 E-07 

3.52E-08 


Table E-E-2. Evacuation Impacts (N/hr) for Each Evacuation Loss Mode 
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Appendix D. MRM-2 Ballistic Limit Equation Inputs 


NASA MRM-2 Ballistic Limit Equation Inputs 


Start ID End ID , 


PIDff Color 


Region 


area Shield bumper bumper standoff rear wall rear wall 
(m2) Type (cm) mafl (cm) (cm) mat* I 


Debris Dcrit PNPISyear 
@7 km/s, 0- (2000d+1991rr 
deg (cm) ) 



From MRM-2_MMOD_Risk_Results_History_v3.xlsx, 12-04-2009 
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RSC-E MRM-2 Ballistic Limit Equation Inputs 



From MRM-2_MMOD_Risk_Results_History_v3.xlsx, 12-04-2009 
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MRM-2 Ballistic Limit Equation Inputs - NASA/RSC-E Comparison 



1.000000 


1.000000 


0.999922 



RSC-E PNP 

NASA PNP 

NASArRSC E 
N Ratio 

NASA:RSC-E Risk 



15 year 

15 year 

Delta 

Comments 

Region 

(2000d+ 1991m) 

(2000d+ 1991m) 

Contribution % 



ladir docking mechanism 
udir docking mechanism 
ladir docking mechanism frame 
dir sphere 

Plate 5 I nadir sphere) 
ladir sphere i zenith nng) 
tadir sphere (short cylinder) 
e frames 
central sphere low standoff 
central sphere - high standoff 
‘entral sphere (zenith ring) 
entral sphere (zenith nng) 
entral sphere (nadir ring] 
entral sphere (nadir ring! 


0.999954 


0.999951 


0 


nputs match, result nearly match 


nputs match, result nearly match 

nputs nearly match, NASA model more refined. 


0 P's. 


0.999530 


0.999515 


I O'*. 


nputs match, result nearly match 


0.999919 


0 2% 


0.999997 

1.000000 


0.999964 

1.000000 


L3J 


.: ZM 


*SC-E rearwall thickness (1.0 cm) does not match NASA rearwall thickness (0.40 cm) 
nputs match, result nearly match 


0.998802 


0 99S2S9 


0.999819 


0.999539 


0 999922 


0.999813 


enith cylinder frame 
tenith cylinder (nadir ring) 
tenith cylinder 

enith sphere under skirt [short 
enith sphere under skirt (long 1 


1.000000 


0.999999 




nputs match, results match 

nputs match, result nearly match (difference probably due to shadowing differences 


0.999928 


0.999873 


3 6"., 


0.999309 


0 999125 


nputs slightly different results nearly match (small area, shadowing differences?) 
nputs match, result nearly match 


0.999994 


0.999998 


0.999999 


0.999999 


zenith sphere • lo w standoff 


> late 4 (zenith s p he re] 


0.998856 


0.998578 


lenith sphere • high standoff 


enith sphere frame 
semth docking mechanism 
amth d ocking mechanism 
:emth docking mechanism frame 
wd/stbd hatch centra l cover ring 
ift/port hatch central cover ring 
wd/stbd hatch central cover 


0.999999 

0.999900 

1.000000 


0.999999 


. C"v 


puts match, result nearly match 


0.999996 


nputs s imilar, results match 

nputs similar, results match 

nputs similar, results match 

nputs similar, results nearly match 


1.000000 




1.000000 


1.000000 


- O'*. 


0.999999 

0.999963 

0.999677 


0.999999 




0.999946 

0.999523 


ift/port hatch central cover 


wd/stbd hatch central window 
■ft/ port hatch central window 


0.999992 
0 999896 


0.999990 

0.999913 


0 :■*. 


nputs similar, results nearly match 
nputs similar, results nearly match 


,f VP ort hatch 

enith hatch - 


hatch • thin wall 


:emth hatch ■ circle 


Regions mapped differently, but are mostly covered by Soyuz docked to zenith port 
nputs similar, areas slightly different 


0.999996 


j 3'*. 


:emth docking mech inside 


?emth docking mech frame 


.hadowing 


0.999997 


1.000000 


•0 1% 


From MRM-2_MMOD_Risk_Results_History_v3.xlsx / 12-04-2009 
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Appendix E. ISS Noncompliance Report NCR-RS-MRM2-01 


Record Number: 
NCR-RS-MRM2-01 


ISS Non-Compliance Report 

Page 

1 

of 


2. Date: 10/06232/09 

| 3. NCR Number 


4. NCR Title: Protection of MRM2 from Meteoroids and Orbital Debris 


5. Hazard Report: RSCE-103-MRM2 


6. Originator: 


Organization: 


Telephone: 


7. Safety Engineer: 


Organization: 


Telephone: 


8. Extends to (Flight): 5R 


9. Date Activities Completed: 5R plus 6 monthsfr om Nov e mb e r 2QQ94f li qht 5R) to Nov e mb e r 2011 -( 2 
years} (10 Nov 2009 to 10 May 2010) 


10. ISS Element Designation: MRM2 


1 1 . Requested Review: 

In Nominal Sequence 


Urgent (basis needs to be given below) 


12. Applicable Requirement: 

SSP 41163, Russian Segment Specification: paragraph 3.3.12.1.1 "Estimated Life of Structure for 
Meteoroid and Space Debris Analysis"; paragraph 3.3.12.1.1.1.1 "Penetration of Structure" and 
paragraph 3.2.6. 1.8 "Meteoroids and Orbital Debris." 


13. Non-Compliance Description: 

The probability of no penetration (PNP) for MRM2 docked to the SM zenith port, which was 
calculated with the BUMPER program using meteoroid environment model SSP30425B and 
ORDEM 1991 and which accounts for the actual situation on the ISS as regards MRM2 including 
USOS movable radiators, is 0.985 over 15 years. This value is less than the value stipulated in SSP 

41163 for PCI, the analogue module of MRM2 (0.996). 


14. Cause as to Why the Requirement cannot be Fulfilled: 

In order to increase MRM2 protection to the required level, it is necessary to install additional 
shielding. This implies a change in its design, an increase in mass (to the extent of not being able to 
launch MRM2 as part of the Progress vehicle), an increase in cost, and a need for experimental 
confirmation of changes in the thermal balance and structural integrity. 


15. Acceptance Rationale: 

1 . In the event of MRM2 penetration, ISS crew action scenarios have been developed with the 
goal of ensuring crew safety and the integrity of the station (SSP 50506). 

2. According to the estimate of RSC Enerqia, Tthe probability of a catastrophic penetration for 
MRM2 (probability of crew death as a result of penetration) over 10 years does not exceed 
6*1 0‘ 5 * 1 2 * (0.9*1 O' 4 over 15 years). The estimate of the probability of a catastrophic penetration for 
MRM2 conducted by NASA is (56*1 0 46 over 105 years (1 in 2070) and 7*1 0 4 over 15 ~ 
years (1 in 1380). The RSC Enerqia Gcalculations were performed with the following 
assumptions: 

- ORDEM 2000 was used; 

- Three possible consequences of penetration of the pressurized hull leading to catastrophic 

consequences in less than 9.5 minutes (the time stipulated in SSP 50506 needed for the crew 
to egress to the Soyuz without deactivating the station) were considered: 
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- destruction of the pressurized hull as a result of the dynamic growth of the crack caused by 
the penetration; 

- Injury or death of crewmembers as a result of waves caused by high-velocity debris formed 
during penetration. 

- Death of the crew as a result of hypoxia brought on by rapid depressurization of the ISS. 

3. The following functions are retained during MRM2 depressurization: 

- MRM2 thermal control; 

- Docking of Progress vehicles and undocking of Soyuz vehicles; 

- Refueling of ISS RS fuel tanks via the MRM2 TMflT. 

4. The volume of air lost during MRM2 depressurization, taking into account the time required to 
isolate the module from the station (16 minutes) is estimated to be 30 m 3 . If a re-pressurization 
is required, these losses may be compensated for either by equalizing pressure with the rest 
of the ISS (volume is approximately 500 m 3 ) as is done after nominal EVA, or by using the 
portable repress tanks (EHII) (there are three located permanently on the ISS RS, which are 
sufficient to pressurize MRM2). 

5. There are the following measures for detecting and isolating a leak (see hazard report RSCE- 
103-MRM2): 

- Upon depressurization of the MRM2 pressurized compartment, a pressure drop emergency 
signal is generated. This emergency signal is displayed on the MRM2 panel and relayed 
throughout RS and USOS modules. 

- The drop in pressure is monitored by pressure sensors installed in MRM2. 

- The depressurized compartment in RS modules, including MRM2, is identified via the 
actuation of air flow sensors installed near ISS RS module docking assemblies. 

6 Th e r e h a v e b ee n no p e n e tr a t i on s- of th e MRM2 an al ogu e , DC1, th a t h a 6 b ee n mat e d to th e I S S 
si nc e 2001 t 

7^6. The PNP estimate according to ORDEM2000 is 0.991 over 15 years. 

gr7\ The capability exists for the ISS to perform an avoidance maneuver for 

orbital debris tracked by a space monitoring system by changing attitude. 

&Q. The US MMOD community and the ISS Chief Safety and Mission 

Assurance Officer believe that the as-is MRM-2 configuration represents an unacceptable long 
term MMOD risk to the ISS Program. Therefore, an agreed to long term risk reduction 
strategy must be developed and implemented within reasonable constraints to appropriately 
mitigate this risk. For example, it is believed that feasible options exist to later augment MRM- 
2 shielding on-orbit, and these options should be fully pursued as part of that long term 
strategy. This NCR has a limited effectivitv to intentionally decouple the MRM-2 launch 
decision from the long term risk management issue. This effectivitv also recognizes the on- 
going high-level discussions with respect to overall ISS MMOD risk, of which this MRM-2 issue 
is a part, and allows time for those discussions to mature. Success criteria for managing this 
NCR at Level II through final risk reduction implementation is prior to expiration of this NCR 
revision, an agreed to plan/schedule is developed, and future NCR revisions track agreed to 
plan/schedule. 
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noAfiMCHOM nwcT k OTneTy o HecooTBeTCTBMM NCR-RS-MRM2 


Mmh. cJjaMMnwfl 

noAnucb 

flaia 

Muxann AracfcOHOB 



BflMecnas Cokohob 



1 ■ — ■ — 1 

BmariMM AiiHynoB 

. 

1 1 

MuxaHn LUyTHKOB 



* AnexcaHAP flMAeHKO 



flaBen Bopo6beB 



Banepnw Rk>mmh 
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Signature Page for Non-Compliance Report NCR-RS-MRM2 


First Name, Last Name 

Signature 

Date 

Vyacheslav Sokolov 






Alexander Telegin 



Boris Ryadinsky 



Konstantin Grigoriev 



Alexey Bideyev 



Vitaly Ainulov 



Mikhail Shutikov 



Alexander Didenko 



Pavel Vorobiev 



Valery Ryumin 
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1. Tracking Number: 

INTERNATIONAL SPACE STATIOK 
SAFETY NONCOMPLIANCE REPORT (NCR) 

Page: of 

2. Date: 

3. NCR Number: NCR-RS-MRM2-01 
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1. Tracking Number: 

INTERNATIONAL SPACE STATIOtV 
SAFETY NONCOMPLIANCE REPORT (NCR) 

Page: of 

2. Date: 

3. NCR Number: NCR-RS-MRM2-01 


21. Approval Signatures: 

21a. Engineering Technical Authority - ISS 


Print Name: 

Phone: 

Signature: 

Date: 

21b. Health and Medical Technical Authority - ISS 


Print Name: 

Phone. 

Signature: 

Date: 

21c. Safety & Mission Assurance Technical Authority - ISS 


Print Name: 

Phone: 

Signature: 

Date: 

21 d. ISS Program Office 


Print Name: 

Phone: 

Signature: 

Date: 


1. Tracking Number: 

INTERNATIONAL SPACE STATlOf 
SAFETY NONCOMPLIANCE REPORT (NCR) 

Page: of 

2. Date: 

3. NCR Number: NCR-RS-MRM2-01 


22. International Partner Signatures 

22a. ASI 




Print Name: 


Phone: 


Signature: 


Date: 


22b. CSA 




Print Name: 


Phone: 


Signature: 


Date: 


22c. ESA 




Print Name: 


Phone: 


Signature: 


Date: 


22d. JAXA 




Print Name. 


Phone: 


Signature: 


Date: 


22e. Roscosmos/RSC-E 




Print Name: 


Phone: 


Signature: 


Date: 
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Appendix F. Stakeholder Briefing for Independent Review of US 
and Russian PRAs for MRM2 MMOD Risk 



Presenter 


Mike Squire 


Date 


December 2009 


Stakeholder Briefing 

Independent Review of US and Russian PRAs for 

MRM2 MMOD Risk 
NESC Request # TI-00592 

Mike Squire 
December 2009 
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Presenter 

Charter 

Mike Squire 

Date 

December 2009 



• NESC Request 

- Review MMOD catastrophic risk assessments for NASA and 
RSC-Energia for the Mini-Research Module 2 (MRM-2) 

• NESC Team 

- Mike Squire/NESC 

- Dana Lear/NASA JSC (KX) 

- Hank Rotter/NASA Technical Fellow for Life Support and Active 
Thermal 

- Dr. Fayssal Safie/NASA Safety Center 

- Dr. William Schonberg/Missouri University of Science and 
Technology 

- Dr. Joel Wlliamsen/lnstitute for Defense Analysis 



Presenter 

Background 

Mike Squire 

Date 

December 2009 



• MMOD probability for catastrophic failure assessments 
between NASA and RSC-Energia presented at the 5R 
Stage Operations Readiness Review (SORR) differed 
considerably 

- NASA: 1 in 1380 (0.07%) vs 

- RSC-E: 1 in 11,100(0.009%) 

- Both are for 15 years 

• Low probability for catastrophic failure risk presented as 
acceptance rationale for ISS NCR-RS-MRM2-01 

- NCR documented probability of no penetration (PNP) for MRM-2 
violating requirement 

• 0.985 for 1 5 years (requirement is PNP >= 0.996 for 1 5 years) 
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Presenter 

Background (cont’d) 

Mike Squire 

Date 

December 2009 



• Recommendations presented at 5R SORR 

- RSC-Energia: 

• Keep MRM-2 MMOD shielding as is for life of the program 

- NASA MMOD and ISS Chief of SMA: 

• Current MMOD shielding for MRM-2 unacceptable for long-term 

• Risk mitigation strategy should be developed by RSC-E to include 
MMOD shielding augmentation to reduce ISS MMOD risk 
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Presenter 

Background 

Mike Squire 

Date 

December 2009 



Location of MRM-2 
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Calculation of Catastrophic Risk 


Presenter 

Mike Squire 

Date 

December 2009 


• Probability of no penetration (PNP) 

- SORR PNP’s were in agreement and not source of divergence 
between NASA and RSC 

* 15 year: 0.992 (NASA) vs. 0.991 (RSC) using 2000 debris model 

• Reduce Loss Factor (R-factor) 

- Ratio of catastrophic penetrations to all penetrations 

- Total R-factor is sum of all R-factors for individual risk modes 

• Probability of no catastrophic failure (PNCF) 

- PNCF = (PNP) r 

- Catastrophic Risk = 1-PNCF 
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Updated Risk Estimates 

Presenter 

Mike Squire 

Date 

December 2009 



RSC-E Risk Estimates have evolved since the SORR 

- Most recent values show ~2x difference between NASA and 
RSC-E rather than ~10x difference observed at SORR and the 





NCR 



RSC-Energia 

| Date 

PNP 

R-Factor 

Risk 

Odds 

Comments ! 

10/6/09 

0.991 

0.010 

9.0e-05 

1 in 
11,111 

Values presented in NCR and SORR, PNP uses 
2000 debris/1991 meteoroid 

12/4/09 

0.9955 

0.0512 

2.3e-04 

1 in 
4294 

Most recent values as of 12/4/09, PNP uses 
2000 debris/1991 meteoroid 


NASA 




Date PNP 

R- 

Factor 

Risk 

Odds 

Comments 

8/25/09 0.992 

0.090 

7.2e-04 

1 in 
1385 

Values presented in NCR and SORR, PNP uses 
2000 debris/MEM 

12/2/09 0.992 

0.077 

6.2e-04 

1 in 
1619 

Most recent values as of 12/4/09, PNP uses 2000 
debris/MEM 

> 12/2/09 0.994 

0.077 

4.8e-04 

1 in 
2101 

Most recent values as of 12/4/09, PNP uses 2000 
debris/1991 Meteoroid 
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NASA and RSC-Energia’s R-factors 


Presenter 

Mike Squire 

Date 

December 2009 


• R-factor Comparison (N/C = not calculated in analysis provided) 


NASA 

R 

RSC-E 

R 

Risk Description 

Comments 

0 

N/C 

Critical Crack (unzipping) causes loss 
of station 


0 

N/C 

External equipment penetration 
causes loss of station 


0.063 

N/C 

Internal systemic equipment 
penetration causes loss of station. 

NASA assumption is the presence of internal 
pressurized tanks. 

0 

0.02435 

Docking unit failure. 


0.004 

0.02519 

Hypoxia causes loss of crew. 

Depends on hole size and time it takes crew 
to egress ISS. RSC-E assumes time of 9.5 
minutes, NASA uses a distribution relating 
crew position and amount of time spent in 
different areas of the ISS. 

0.010 

0.00168 

Fragmentation causes loss of crew. 

NASA probably assumed a higher occupancy 
rate than RSC-E 

0 

N/C 

Thrust induced angular velocity 
causes loss of crew. 




Presenter 

R-factors (cont’d) 

Mike Squire 

Date 

December 2009 



• NASA R-factor (using numbers from previous chart) 

- 0.063+0.004+0.01 = 0.077 


• RSC-E R-factor (using numbers from previous chart) 

- 0.02435+0.02519+0.00168 = 0.05122 

• For MRM-2 R-factors are not equal but close 

- NASA R-factor = 0.077 

- RSC-E R factor = 0.05122 

• An upper bound for R-factor may be approximated by 
adding the worst case values from NASA and RSC-E 

- 0.063 (internal system failure) + 0.02435 (docking system failure) 
+ 0.02519 (hypoxia) + 0.01 (fragmentation) = 0.123 
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Possible Reasons for Differences from 

Presenter 

Mike Squire 

October to December 

Date 

December 2009 


• Known factors affecting RSC-E increase in risk 

- PNP calculations now use actual stand-off distance between 
outer shield and pressure wall (larger than previous) 

- Starting year for debris and meteoroid models changed from 
1998 to 2009 

- R-factor updated from 0.010 to 0.0512 

• Factors affecting NASA decrease in risk 

- Incorrect initial R-Factor of 0.090 corrected to 0.077 
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Possible Reasons for Remaining Difference 

Presenter 

Mike Squire 

between NASA and RSC-Energia 

Date 

December 2009 


* Suspect that RSC-E may be using older FEM than NASA, 
which affects the PNP. 


• PNP calculations use different property identification 
(PID) mapping (see back-up charts for enlarged views) 
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Differences between NASA and RSC-Energia 

Presenter 
Mike Squire 

Date 

December 2009 



• Differing assumptions result in different R-factors 0.077 
(NASA) vs. 0.0512 (RSC-E) 


NASA 

R 

RSC-E 

R 

Risk Description 

Comments 

0 

N/C 

Critical Crack (unzipping) causes loss 
of station 


0 

N/C 

External equipment penetration 
causes loss of station 


0.063 

N/C 

Internal systemic equipment 
penetration causes loss of station. 

NASA assumption is the presence of internal 
pressurized tanks. 

0 

0.02435 

Docking unit failure. 


0,004 

0.02519 

Hypoxia causes loss of crew. 

Depends on hole size and time it takes crew 
to egress ISS. RSC-E assumes time of 9.5 
minutes, NASA uses a distribution relating 
crew position anc amount of time spent in 
different areas of the ISS. 

0.010 

0.00168 

Fragmentation causes loss of crew. 

NASA probably assumed a higher occupancy 
rate than RSC-E 

0 

N/C 

Thrust induced angular velocity 
causes loss of crew. 
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Additional possible reasons 

Presenter 

Mike Squire 

to explain R-factor differences 

Date 

December 2009 


• NASA calculates R-factor using MSCSurv 

• Some empirical equations for pressure wall hole diameter and 
crack length believed being used are based on data from testing 
at 6.5 km/s only, some based on data at 6.5 and at 11 .3 km/s. 

• If single-velocity equations are being used, how are other impact 
velocities accounted for? 

- Equations believed being used derived from testing on targets 
with different configuration than MRM-2 wall geometry 

• Bumper stand-off distances for MRM-2 less than test configuration 

• One of the MLI blankets on MRM-2 not present in test configuration 

• How are configuration differences accounted for? 
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Additional possible reasons 

Presenter 

Mike Squire 

to explain R-factor differences 

Date 

December 2009 


• RSC uses empirical equations for pressure wall hole 
diameter and crack length developed in a 1995 
NASA/ASEE study 

- Equations are derived from testing at 6.5 km/sec only 

• How are other impact velocities accounted for? Same technique as 
NASA or somehow else? 

- Equations derived from testing on targets with different m 
configuration than MRM-2 wall geometry 

• Bumper stand-off distances for MRM-2 less than test configuration 

• One of the MLI blankets on MRM-2 not present in test configuration 

• How are configuration differences accounted for? Same technique 
as NASA or somehow else? 
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Presenter 

Findings 

Mike Squire 

Date 

December 2009 



• F-1 : Based on the risk assessment for either source, 
augmented MMOD shielding is warranted for MRM-2. 


• F-2: According to the most recently produced values, the 
discrepancy between NASA and RSC-Energia’s risk is 
now approximately a factor of 2 instead of the factor of 10 
displayed at the 5R SORR. 

• F-3: The work NASA and RSC-E have planned is 
appropriate to close the gap between the MMOD risk 
assessments. 


• F-4: Variations in PNP between NASA and RSC-E may be 
caused by 

- RSC-E may be using older FEM than NASA. 

- PNP calculations use different property identification mapping. 

- Differing assumptions result in different R-factors. 
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• F-5: The components of the individual R-factors are 
different, and this may cause a larger variation in PNCF 
than either NASA or RSC-E are currently accounting for. 
Variations in R-factor between NASA and RSC-E may be 
caused by: 

- RSC-E assumes no risk due to pressurized tanks within the 
module while NASA does. 

- NASA does not account for docking mechanism failure. 

- RSC-E assumed higher risk of hypoxia. 

- RSC-E assumes lower risk to fragmentation (function of time 
spent in module). 
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• F-6: With the information available, there is no way to 
judge which of the two current PNCFs is more 
appropriate - the assumptions going into the two PNCFs 
are not yet aligned with one another. 

• F-7: Different uncertainty assumptions may also 
contribute to different risk assessments 

- This was not explored in depth in this study. 

• F-8: Currently, there is no NASA mechanism for 
incorporating changes in the R-factor due to model 
changes, shield changes, operational changes, etc. 

- NASA is working on rectifying this 
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Recommendations 


• R-1: Install additional MMOD shielding to reduce the PNP 
to the level specified in the requirements. 

• R-2: NASA and RSC-Energia should continue to work to 
further narrow the gap between R-factors and PCF for 
MRM-2. 

- NASA plans to run Bumper using RSC-E’s FEM and ballistic limit 
equation inputs. 

• R-3: Define uncertainties in PCFs and the terms going 
factored into their calculation. 

• R-4: Proceed with current NASA plans to update R- 
factors in risk assessments. 
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